TavernKeeper Scan Report

doolijb/serene-pub

Commit f8be0fb Reviewed Sep 1, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 56 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: tooling
Source: scripts/prune-dist.js:239

Deterministic technical evidence (36)

zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:206
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:107
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:352
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: src/lib/server/sockets/koboldcpp.allowedHost.test.ts:31
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: src/lib/server/koboldcpp/binaryManager.allowedHost.test.ts:39
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/docker.yml:22
zizmor reported template-injection · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/build-android.yml:127
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/build-android.yml:58
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/build-android.yml:63
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:202-203
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/docker.yml:21-29
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/build-android.yml:58
JavaScript analysis reported javascript.xray.data-exfiltration · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/check-db-lock.js:3
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/docker.yml:56
zizmor reported excessive-permissions · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:14-138
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:206
zizmor reported excessive-permissions · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:1-359
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: test-documentation-data

Source: src/lib/shared/utils/docsIndex.test.ts:92
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/build-android.yml:23-28
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:107
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/docker.yml:89
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:28-29
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/docker.yml:78
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: src/lib/shared/utils/normalizeBaseUrl.test.ts:6
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: src/lib/server/cardSources/githubYamlCardSource.test.ts:34
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:203
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:29
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: svelte.config.js:16
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/build-android.yml:24
OpenGrep reported tavernkeeper.dynamic-execution.node-shell · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: tooling-only

Source: scripts/check-db-lock.js:232-235
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/docker.yml:50
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/docker.yml:53
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: svelte.config.js:81
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: src/lib/server/utils/uuid.test.ts:15
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/build-android.yml:145
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/check-db-lock.js:29

Contextual expected matches (18)

JavaScript analysis reported javascript.xray.data-exfiltration

Expected behavior · high confidence

The file imports a standard system module to find the operating system temporary folder. This is used to create a throwaway directory for test data. No information is sent anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.data-exfiltration. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.data-exfiltration
File role: production
Source: vitest.setup.ts:22

Credential access and network transmission in one file

Expected behavior · high confidence

This is the same authentication helper file flagged by a different scanner. It fetches the user's own login token from the app's server to enable real-time chat. The token is never sent anywhere except back to the app itself.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: Same file as the prior group, flagged by a separate scanner for credential source and network sink in one file. The fetch on line 11 targets the same-origin relative path /api/socket-token with credentials included, which is the standard pattern for retrieving the authenticated user's own socket token from the application backend. The cookie and localStorage reads in the same file are fallback token retrieval paths. No external destination is involved and no exfiltration path is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: src/lib/client/auth.ts:11

OpenGrep reported tavernkeeper.dynamic-execution.node-shell

Expected behavior · high confidence

The script makes a macOS app launcher executable after creating it. This is a standard step in building app bundles and poses no security risk because no external input controls the command.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell. The match applies to this repository.

Contextual assessment: This candidate flags the execSync call at line 264, which runs chmod +x on the macOS app bundle executable script that was just written by fs.writeFileSync at line 261. The path is derived from path.join(macOSDir, 'serene-pub') where macOSDir is built from the script's own __dirname and hardcoded directory names. No untrusted input flows into the command. This is expected behavior for a packaging script that must set executable permissions on generated launcher scripts.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.node-shell
File role: tooling
Source: scripts/create-executables.js:264

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This file loads configuration from a .env file early in the server startup process and fills in some proxy-related settings the server framework needs. It only reads and writes local environment variables for configuration purposes. No data is sent anywhere over the network.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: JS-X-Ray flagged a serialize-environment signal triggered by process.env access. This server-side preloader reads .env via dotenv and conditionally writes derived reverse-proxy configuration variables (ADDRESS_HEADER, HOST_HEADER, PROTOCOL_HEADER, ORIGIN) into process.env when the operator has not already set them. The process.env reads and writes are standard configuration-loading behavior with no network sink in this file. No environment data is serialized for transmission or exfiltration. The derived values are recorded on a globalThis marker solely for the startup banner to report what was applied.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: production
Source: src/lib/server/config/preloadEnv.js:37

Credential access and network transmission in one file

Expected behavior · high confidence

This file connects the user to the app's own real-time server for live chat sync. It gets the user's login token from the app's server and uses it to authenticate the WebSocket connection to that same server. The token goes only to the app itself, not to any outside party.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The file retrieves a socket auth token via a same-origin fetch to /api/socket-token, then passes that token in the auth field of the socket connection options. The socket host is derived from the app's own /api/sockets-endpoint response or window.location.origin, so the token is transmitted only to the application's own socket server. The redacted value on line 70 is the authToken variable reference, not a hardcoded secret. This is the standard pattern for authenticating a WebSocket connection in a multi-user SvelteKit application and matches the project's stated live-sync multiplayer purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: src/lib/client/sockets/loadSockets.client.ts:20

JavaScript analysis reported javascript.xray.unsafe-command

Expected behavior · high confidence

A scanner flagged a shell command in a build script. The command uses a fixed package name and a path computed from the script's own location, with no external or user-controlled input. This is a normal build-step utility, not a security issue.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-command. The match applies to this repository.

Contextual assessment: JS-X-Ray flagged the execSync call at lines 168-171 as an unsafe-command signal. The command string is constructed from nodeMobilePkg, which is a hardcoded string literal (nodejs-mobile-react-native@18.20.4), and tempDir, which is derived from the script's own filesystem location via path.join(rootDir, 'temp-nodejs-mobile'). No user input, external data, or untrusted content flows into the command. This is a build-time tooling script that fetches a specific npm tarball to extract native libraries for Android packaging, running in CI or local developer build contexts. The scanner confidence is low, and the actual data flow shows no injection path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-command
File role: tooling
Source: scripts/build-android.js:168-171

zizmor reported superfluous-actions

Expected behavior · high confidence

A code-quality scanner noted that this release-uploading action might duplicate something the runner already does. This is not a security problem. The workflow is well-structured with limited permissions and safe handling of tag names.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: The zizmor superfluous-actions info finding flags the use of softprops/action-gh-release@v2 as potentially redundant with runner-included functionality. This is a code-quality hint, not a security vulnerability. The workflow properly narrows permissions to contents:write, passes REF_NAME through an environment variable rather than direct interpolation into run blocks, and uses secrets.GITHUB_TOKEN for release asset uploads. No attacker-controlled input reaches the release action; file paths come from a prior step output derived from a hardcoded version string and CI-produced build artifacts.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: zizmor 1.28.0
Rule: superfluous-actions
File role: tooling
Source: .github/workflows/build-android.yml:145

JavaScript analysis reported javascript.credential-to-network

Expected behavior · high confidence

This file handles getting the user's own login token so they can connect to the app's real-time chat feature. It fetches the token from the app's own server and falls back to checking the browser's cookie or local storage. Nothing is sent to any outside service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.credential-to-network. The match applies to this repository.

Contextual assessment: The scanner flags co-occurrence of credential-bearing state reads (document.cookie, localStorage) and an outbound fetch in the same file. The fetch targets a same-origin relative endpoint (/api/socket-token) to retrieve the user's own socket authentication token. The cookie and localStorage reads are fallback paths for the same auth token. All data flows remain within the application's own origin and serve the stated multi-user WebSocket authentication purpose. No credentials are transmitted to any external or third-party destination.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.credential-to-network
File role: production
Source: src/lib/client/auth.ts:11-36

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The scanner saw complicated-looking text patterns and worried the code was hiding something. Reading it, this script just decorates the finished server program: it adds a logo and friendly startup/shutdown messages, makes the app open once in your own browser when the local server starts (which you can switch off with a setting), and makes your saved settings load a bit earlier. Everything it does is written out plainly with explanatory comments and nothing is sent anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: tooling
Source: scripts/customize-build.js:1

zizmor reported superfluous-actions

Expected behavior · high confidence

A scanner suggested this release-upload action may be unnecessary. That is a style preference, not a security risk. The workflow safely handles credentials and tag names.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: The zizmor superfluous-actions info finding targets the softprops/action-gh-release@v2 step in the release workflow. This is a quality suggestion, not a security issue. The job scopes permissions to contents:write, uses environment variables (REF_NAME) instead of direct interpolation to prevent script injection, and uses secrets.GITHUB_TOKEN for authenticated release uploads. File inputs are glob patterns matching CI-produced zip artifacts and step outputs from prerelease detection. No untrusted or attacker-controlled data flows into the action inputs in a way that creates concrete harm.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: zizmor 1.28.0
Rule: superfluous-actions
File role: tooling
Source: .github/workflows/release.yml:352

Credential access and network transmission in one file

Expected behavior · high confidence

This file is the connector that sends chat prompts to the user's own KoboldCPP AI model server and receives responses. The scanner saw network calls in a file that also reads connection settings, but the network calls go only to the user's own configured AI server. This is exactly what the app is supposed to do.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The scanner flags credential access and network transmission in one file. The credential-bearing state identified is this.connection.baseUrl, which is a user-configured KoboldCPP server URL, not a secret credential. The fetch calls target the user's own KoboldCPP instance to query context limits, send generation requests, and abort in-flight generations. All network destinations are derived from the user's own connection configuration. This is the core functionality of a KoboldCPP connection adapter in an AI roleplay application and matches the project's stated purpose of connecting to local or user-configured LLM backends. No credentials are exfiltrated to any third-party destination.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: src/lib/server/connectionAdapters/KoboldCppAdapter.ts:116

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The file checks two environment variables to decide where to put temporary test data, then sets one so tests use a throwaway folder instead of real data. No environment information is collected or sent anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The scanner flagged access to process.env as a serialize-environment signal. In the supplied source, process.env is read for two variables: SERENE_PUB_DATA_DIR and VITEST_WORKER_ID. One is then written with a temporary directory path. This is legitimate test infrastructure behavior that redirects test database operations away from real user data. No environment contents are serialized, transmitted, logged, or sent to any external destination. The signal is a false positive on standard test setup configuration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: production
Source: vitest.setup.ts:25

OpenGrep reported tavernkeeper.dynamic-execution.node-shell

Expected behavior · high confidence

A scanner flagged a shell command in a build script. The command only uses a fixed package name and a locally-computed path, with no external input. This is a standard build utility action, not a security risk.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell. The match applies to this repository.

Contextual assessment: OpenGrep matched the execSync call at lines 169-172 for Node process execution. The command interpolates nodeMobilePkg (a hardcoded string constant) and tempDir (a path derived from the script's own directory). Neither value is attacker-controlled or sourced from untrusted input. The script runs as a build tool in CI or local build contexts. This is expected behavior for a build script that invokes npm pack to fetch a specific package tarball.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.node-shell
File role: tooling
Source: scripts/build-android.js:169-172

OpenGrep reported tavernkeeper.dynamic-execution.node-shell

Expected behavior · high confidence

The script sets executable permissions on a Linux installer file it just created. This is a normal packaging step with no security concern.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell. The match applies to this repository.

Contextual assessment: This candidate flags the execSync call at line 180, which runs chmod +x on the Linux desktop-shortcut installer script that was just written at line 177. The path is constructed from path.join(platformDir, 'install-desktop-shortcut.sh') using internally-derived directory values. No external or user-controlled input reaches the command string. Making generated install scripts executable is expected behavior for a release packaging tool.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.node-shell
File role: tooling
Source: scripts/create-executables.js:180

OpenGrep reported tavernkeeper.dynamic-execution.node-shell

Expected behavior · high confidence

The script makes a Linux app launcher executable after creating it. This is a routine build step with no external input involved.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell. The match applies to this repository.

Contextual assessment: This candidate flags the execSync call at line 201, which runs chmod +x on the Linux executable wrapper script just written at line 198. The path comes from path.join(platformDir, config.executable) where config.executable is the hardcoded string 'Serene Pub'. No untrusted input is involved. Setting executable permissions on a generated launcher is standard and expected for a cross-platform packaging script.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.node-shell
File role: tooling
Source: scripts/create-executables.js:201

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This is a build helper that creates clickable app launchers for Windows, Linux, and macOS. The security scanner flagged it because a piece of generated Linux code contains complex escape characters that look suspicious to automated tools, but the code is actually straightforward and well-documented. There is nothing hidden or malicious here.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The flagged file is a transparent Node.js packaging script that reads package.json, copies a favicon, and writes platform-specific launcher scripts (Windows .bat, Linux shell wrappers, macOS .app bundle). The obfuscation signal is a false positive, most likely triggered by the heavily-escaped sed expression embedded in the generated bash installer (line 153), which contains multiple backslash sequences for desktop-entry escaping. The surrounding code is readable, well-commented, and contains no encoded strings, eval, or hidden control flow. All file paths are derived from the script's own directory and hardcoded config values; no untrusted input is involved.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: tooling
Source: scripts/create-executables.js:1

JavaScript analysis reported javascript.xray.unsafe-command

Expected behavior · high confidence

The build script runs a simple chmod command to make the launcher files it just created executable. This is normal and necessary for Linux and macOS app launchers. There is no way for outside input to influence what command runs.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-command. The match applies to this repository.

Contextual assessment: The three execSync calls (lines 180, 201, 264) each run chmod +x on files the script itself just created via fs.writeFileSync. The command arguments are constructed from path.join using the script's own __dirname, hardcoded platform directory names, and hardcoded config values (e.g., 'Serene Pub', 'serene-pub', 'install-desktop-shortcut.sh'). No user-controlled or external input reaches the command string. Running chmod on freshly generated shell scripts is expected and necessary behavior for a cross-platform packaging tool.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-command
File role: tooling
Source: scripts/create-executables.js:179

OpenGrep reported tavernkeeper.dynamic-execution.node-shell

Expected behavior · high confidence

A scanner flagged a tar extraction command in a build script. The filename comes from a temp directory that the script itself just created and filled, not from external input. This is a normal build step, not a security issue.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell. The match applies to this repository.

Contextual assessment: OpenGrep matched the second execSync call at lines 178-180, which runs tar extraction. The tarball filename is obtained from fs.readdirSync on a temp directory that was just created and populated solely by the preceding npm pack command. The tempDir path is derived from the script's own location. No external or attacker-controlled input reaches this command. The tarball content comes from the official npm registry for a pinned package version. This is expected build-time behavior in a tooling script.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.node-shell
File role: tooling
Source: scripts/build-android.js:178-180

Related contextual observations

Test setup file uses local filesystem and environment access for isolation

low risk · high confidence

This is a test helper that makes sure tests do not accidentally touch real user data by creating a disposable folder for each test run. Everything it does stays on the local machine.

Technical assessment

The entire file is a Vitest setup script whose stated purpose is to redirect test database operations to a temporary directory. It uses node fs, os, and path modules to create and clean up that directory, and reads or writes two environment variables to coordinate the path. All operations are local, occur during test execution, and serve a defensive isolation purpose. No network, credential, or external data flow is present.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Inventory: 1019 files · 136470526 bytes
Contextual coverage: 55 of 55 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 449 files · 3688979 bytes
X-Ray review families: 50 warning occurrences compacted to 18 evidence-preserving review families
Representations: 449 raw · 14 decoded · 1 normalized · 0 bundle modules
Stage scans: 449 raw signatures · 67 raw AST · 446 raw OpenGrep · 15 derived signatures · 1 derived AST · 14 derived OpenGrep

Unresolved JavaScript stages

scripts/bundle-dist.js — derived-opengrep / parse
scripts/bundle-dist.js — raw-opengrep / parse
src/app.d.ts — raw-ast / parse
src/hooks.server.ts — derived-ast / parse
src/hooks.server.ts — normalize / parse
src/hooks.server.ts — raw-ast / parse
src/hooks.ts — raw-ast / parse
src/lib/client/accessibility/state.svelte.test.ts — raw-ast / parse
src/lib/client/accessibility/state.svelte.ts — raw-ast / parse
src/lib/client/auth.ts — raw-ast / parse
src/lib/client/components/.svelte-kit/ambient.d.ts — raw-ast / parse
src/lib/client/components/graph/edgeGeometry.aggregate.test.ts — raw-ast / parse
src/lib/client/components/graph/edgeGeometry.test.ts — raw-ast / parse
src/lib/client/components/graph/edgeGeometry.ts — raw-ast / parse
src/lib/client/components/lorebookForms/graphTimeline.test.ts — raw-ast / parse
src/lib/client/components/lorebookForms/graphTimeline.ts — raw-ast / parse
src/lib/client/consts/Theme.ts — raw-ast / parse
src/lib/client/services/connectionTimeout.ts — raw-ast / parse
src/lib/client/sockets/loadSockets.client.ts — raw-ast / parse
src/lib/client/sockets/typedSocket.ts — raw-ast / parse
src/lib/client/stores/sceneImages.ts — raw-ast / parse
src/lib/client/utils/attachLorebookToChat.ts — raw-ast / parse
src/lib/client/utils/authFlow.ts — raw-ast / parse
src/lib/client/utils/createLorebookBinding.ts — raw-ast / parse
src/lib/client/utils/downloadBlob.ts — raw-ast / parse
src/lib/client/utils/keyboardNavigation.ts — raw-ast / parse
src/lib/client/utils/markdownToHTML.ts — raw-ast / parse
src/lib/client/utils/motion.ts — raw-ast / parse
src/lib/client/utils/sillyTavernFolderImport.test.ts — raw-ast / parse
src/lib/client/utils/sillyTavernFolderImport.ts — raw-ast / parse
src/lib/client/utils/tiptapHandlebarsLint.ts — raw-ast / parse
src/lib/client/utils/tiptapLegacyTag.ts — raw-ast / parse
src/lib/client/utils/tiptapLorebookBindingTag.ts — raw-ast / parse
src/lib/client/utils/viewMode.svelte.ts — raw-ast / parse
src/lib/server/auth/authenticateRequest.ts — raw-ast / parse
src/lib/server/auth/cookies/cookieSecurity.int.test.ts — raw-ast / parse
src/lib/server/auth/cookies/cookieSecurity.ts — raw-ast / parse
src/lib/server/auth/cookies/deleteUserTokenCookie/index.ts — raw-ast / parse
src/lib/server/auth/cookies/deleteUserTokenCookie/int.test.ts — raw-ast / parse
src/lib/server/auth/cookies/setUserTokenCookie/index.ts — raw-ast / parse
src/lib/server/auth/cookies/setUserTokenCookie/int.test.ts — raw-ast / parse
src/lib/server/auth/tokens/decryptLocalToken/index.ts — raw-ast / parse
src/lib/server/auth/tokens/generateLocalToken/index.ts — raw-ast / parse
src/lib/server/cardSources/cache.ts — raw-ast / parse
src/lib/server/cardSources/charaVault/charaVaultSource.contentSafety.int.test.ts — raw-ast / parse
src/lib/server/cardSources/charaVault/charaVaultSource.imageTimeout.test.ts — raw-ast / parse
src/lib/server/cardSources/charaVault/charaVaultSource.ts — raw-ast / parse
src/lib/server/cardSources/charaVault/contentFilter.ts — raw-ast / parse
src/lib/server/cardSources/charaVault/rateLimiter.test.ts — raw-ast / parse
src/lib/server/cardSources/charaVault/rateLimiter.ts — raw-ast / parse
src/lib/server/cardSources/charaVault/session.ts — raw-ast / parse
src/lib/server/cardSources/diskCache.test.ts — raw-ast / parse
src/lib/server/cardSources/diskCache.ts — raw-ast / parse
src/lib/server/cardSources/githubYamlCardSource.ts — raw-ast / parse
src/lib/server/cardSources/inFlightRequests.test.ts — raw-ast / parse
src/lib/server/cardSources/inFlightRequests.ts — raw-ast / parse
src/lib/server/cardSources/index.ts — raw-ast / parse
src/lib/server/cardSources/pendingAbortableFetch.test.ts — raw-ast / parse
src/lib/server/cardSources/pendingAbortableFetch.ts — raw-ast / parse
src/lib/server/cardSources/types.ts — raw-ast / parse
src/lib/server/config/bootstrapEnv.test.ts — raw-ast / parse
src/lib/server/config/bootstrapEnv.ts — derived-ast / parse
src/lib/server/config/bootstrapEnv.ts — normalize / parse
src/lib/server/config/bootstrapEnv.ts — raw-ast / parse
src/lib/server/connectionAdapters/AnthropicAdapter.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/AnthropicAdapter.ts — raw-ast / parse
src/lib/server/connectionAdapters/BaseConnectionAdapter.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/BaseConnectionAdapter.ts — raw-ast / parse
src/lib/server/connectionAdapters/KoboldCppAdapter.idleTimeout.int.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/KoboldCppAdapter.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/KoboldCppAdapter.ts — raw-ast / parse
src/lib/server/connectionAdapters/KoboldCppManagedAdapter.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/KoboldCppManagedAdapter.ts — raw-ast / parse
src/lib/server/connectionAdapters/LMStudioAdapter.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/LMStudioAdapter.ts — raw-ast / parse
src/lib/server/connectionAdapters/LlamaCppAdapter.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/LlamaCppAdapter.ts — raw-ast / parse
src/lib/server/connectionAdapters/OllamaAdapter.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/OllamaAdapter.ts — raw-ast / parse
src/lib/server/connectionAdapters/OpenAIChatAdapter.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/OpenAIChatAdapter.ts — raw-ast / parse
src/lib/server/connectionAdapters/idleTimeout.ts — raw-ast / parse
src/lib/server/connectionAdapters/jsonSchemaToGbnf.test.ts — raw-ast / parse
src/lib/server/connectionAdapters/jsonSchemaToGbnf.ts — raw-ast / parse
src/lib/server/db/defaults.seedIdSequence.test.ts — raw-ast / parse
src/lib/server/db/defaults.seedKey.int.test.ts — raw-ast / parse
src/lib/server/db/defaults.ts — raw-ast / parse
src/lib/server/db/drizzle.config.ts — raw-ast / parse
src/lib/server/db/index.ts — raw-ast / parse
src/lib/server/db/postgres.ts — raw-ast / parse
src/lib/server/db/sceneCastMigration.int.test.ts — raw-ast / parse
src/lib/server/db/schema.ts — raw-ast / parse
src/lib/server/db/types.d.ts — raw-ast / parse
src/lib/server/db/userSettingsUniqueConstraint.int.test.ts — raw-ast / parse
src/lib/server/embedding/index.ts — raw-ast / parse
src/lib/server/embedding/loadConfiguredEmbeddingModel.test.ts — raw-ast / parse
src/lib/server/embedding/models.ts — raw-ast / parse
src/lib/server/embedding/ragContext.fetchScoreSplit.int.test.ts — raw-ast / parse
src/lib/server/embedding/ragContext.ts — raw-ast / parse
src/lib/server/embedding/startPeriodicVectorizationScan.test.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — not-applicable
zizmor 1.28.0 — completed
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: f8be0fba5dacc6ab68a9dd3668e4454afabed16d
Completed: Sep 1, 2026
History depth: 2 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 1 fresh / 13 reused groups · 1 fresh / 17 reused candidates
Review source reports: 1a69de60fcaee4eeaf965aee7918499fbc6fbe115e4d9e76fa7ececef9489894
Evidence triage: 37 deterministic / 18 contextual candidates · 14 contextual / 27 total behavior cases
Model budget: 1 model call · 1 / 12 fresh cases · 15663 / 200000 estimated input · 12379 / 250000 actual input · 1885 / 40000 output tokens
Review batching: 1 model call · up to 1 groups and 1 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 12379 input · 1885 output · 0 cache read · 0 reasoning tokens
Report: af0d699c3eb4a8306e2fbdd3f4b20e947722c7b37a4508f10b6720ecead77f3f