# Risk map — biomejs/biome

> Canonical page: https://codevetter.com/unpack/biome/risk-map

# Risk map — biomejs/biome

Scanned commit 82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443 (2026-09-21). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The highest-risk surfaces are the daemon socket, arbitrary filesystem reads during project scan, shell-free but powerful code actions that rewrite user trees, and the migrate command that ingests third-party configs. Generated registries mean a hand edit can be overwritten. Type inference and the service layer are blast-radius hotspots: a small change can break every language. Secrets are not a primary domain; the tool still reads every file the user points it at.
- The daemon listens on a local socket and executes workspace operations for connecting clients. A local process that can connect can request lint, format, and file reads of the project the daemon was started in. — [crates/biome_cli/src/commands/daemon.rs](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_cli/src/commands/daemon.rs) [crates/biome_lsp/src/lib.rs](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_lsp/src/lib.rs)
- biome rage prints configuration, environment, and paths to help bug reports. It can leak local paths and config contents if users paste the output. — [crates/biome_cli/src/commands/rage.rs](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_cli/src/commands/rage.rs)
- Code actions and --write mutate source files in place. Unsafe fixes are distinguished from safe ones in the analyzer, but a wrong fix kind still rewrites user code when the flag is passed. — [crates/biome_analyze/src/lib.rs](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_analyze/src/lib.rs) [crates/biome_cli/src/commands/check.rs](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_cli/src/commands/check.rs)
- Migrate parses ESLint and Prettier configs from the target project. It does not evaluate arbitrary JavaScript plugins the way ESLint does, but it does read and rewrite configuration files. — [crates/biome_cli/src/commands/migrate.rs](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_cli/src/commands/migrate.rs)
- biome_service and biome_analyze are blast-radius hubs. Registry, settings, and file-handler changes affect every language CLI command and the LSP. — [crates/biome_service/src/workspace.rs](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_service/src/workspace.rs) [crates/biome_analyze/src/registry.rs](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_analyze/src/registry.rs)
- Historical Rome names remain in fuzz package metadata and some comments. Treating those crates as the current product name will point agents at the wrong APIs. — [fuzz/Cargo.toml#L1-L30](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/fuzz/Cargo.toml#L1-L30) [README.md](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/README.md)
- Salsa type queries cache aggressively. A query that captures the wrong revision or ignores file invalidation will make type-aware rules report stale results. The type-inference skill calls this out as a dedicated test surface. — [.claude/skills/type-inference/SKILL.md](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/.claude/skills/type-inference/SKILL.md) [crates/biome_js_type_info/src/lib.rs](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_js_type_info/src/lib.rs)
- Logging via BIOME_LOG_PATH writes logs under a user-controlled directory. The CLI creates that directory from the environment variable at startup. — [crates/biome_cli/src/main.rs#L1-L50](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/crates/biome_cli/src/main.rs#L1-L50)
- CI and release workflows can publish npm binaries and crates. A mistaken change to package metadata or the release workflow has distribution blast radius beyond the compiler. — [.github/workflows/main.yml](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/.github/workflows/main.yml) [.github/workflows/beta.yml](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/.github/workflows/beta.yml) [packages/@biomejs/biome/package.json](https://github.com/biomejs/biome/blob/82f9b0e6ff4bdc4a99aa81b1b861934aa9cb9443/packages/%40biomejs/biome/package.json)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)