# Risk map — avajs/ava

> Canonical page: https://codevetter.com/unpack/ava/risk-map

# Risk map — avajs/ava

Scanned commit bbfd946322fdeca2b547a691d947fb4e18c0c67f (2026-05-17). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The main security-sensitive boundaries are executable configuration, arbitrary test/setup imports, inherited worker environments, inspector access, IPC, and filesystem writes. These are source observations about a developer tool that executes project code, not confirmed vulnerabilities. Additional correctness concerns involve snapshot durability, dependency tracing limits, and an error-handling branch identified by inspection. No runtime reproduction or exhaustive security audit was performed.
- Configuration discovery imports ava.config.js/.mjs and invokes exported factories before test workers exist; automatic upward search means parent-directory configuration can execute in the CLI process. — [lib/load-config.js#L13-L26](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/load-config.js#L13-L26) [lib/load-config.js#L108-L124](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/load-config.js#L108-L124) [lib/load-config.js#L138-L146](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/load-config.js#L138-L146)
- Both worker modes inherit process.env and apply configured overrides; worker isolation does not filter inherited environment values, and childProcess.fork launches Node with supplied execArgv. — [lib/fork.js#L22-L51](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/fork.js#L22-L51) [lib/environment-variables.js#L1-L12](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/environment-variables.js#L1-L12)
- Setup modules and test paths execute via dynamic import or provider loaders; dependency setup resolution can write import-from-project.mjs under project node_modules even independently of provider cache selection. — [lib/worker/base.js#L164-L204](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/worker/base.js#L164-L204) [lib/worker/base.js#L207-L228](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/worker/base.js#L207-L228)
- Debug mode accepts a configurable inspector host and port and calls inspector.open(..., true); the CLI default host is 127.0.0.1 and debugging is rejected in CI. — [lib/cli.js#L182-L190](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/cli.js#L182-L190) [lib/cli.js#L302-L309](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/cli.js#L302-L309) [lib/worker/base.js#L215-L220](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/worker/base.js#L215-L220)
- Snapshot destinations incorporate source-map source paths or configured locations, while glob discovery follows symlinks; snapshot writes/deletions and temporary cache creation are filesystem boundaries that can extend beyond the checkout. — [lib/snapshot-manager.js#L421-L455](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/snapshot-manager.js#L421-L455) [lib/snapshot-manager.js#L475-L484](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/snapshot-manager.js#L475-L484) [lib/globs.js#L78-L94](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/globs.js#L78-L94) [lib/api.js#L327-L332](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/api.js#L327-L332)
- Hypothesis: separate concurrent atomic writes for .snap and .md protect each file individually but can leave the pair inconsistent if one write fails; updating also deliberately discards snapshot decoding errors. (inferred) — [lib/snapshot-manager.js#L403-L413](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/snapshot-manager.js#L403-L413) [lib/snapshot-manager.js#L515-L524](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/snapshot-manager.js#L515-L524)
- Hypothesis: a rejection from globs.findTests() leaves testFiles undefined, after which selectionInsights reads testFiles.length before the later reporting try/catch; this may bypass intended internal-error reporting. (inferred) — [lib/api.js#L149-L176](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/api.js#L149-L176) [lib/api.js#L310-L315](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/api.js#L310-L315)
- Watch tracing intentionally ignores installed dependencies and non-exact file references, and config modules are not reloaded; observeRun's iterator additionally stops after the first run, with multi-run support marked TODO. — [lib/watcher.js#L814-L824](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/watcher.js#L814-L824) [lib/globs.js#L26-L31](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/globs.js#L26-L31) [lib/api-event-iterator.js#L1-L12](https://github.com/avajs/ava/blob/bbfd946322fdeca2b547a691d947fb4e18c0c67f/lib/api-event-iterator.js#L1-L12)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)