CodeVetter · Repo Unpack · Risk map
blitz-js/blitz
These are source observations and explicitly identified hypotheses, not confirmed vulnerabilities. The highest-impact boundaries are resolver exposure, authentication state, logging, and CLI filesystem/process side effects. Example applications contain behavior that differs materially from generated templates. Separate Pages and App Router implementations and upstream-internal imports create maintenance and verification obligations.
- The toolkit-app default login has authenticateUser commented out, ignores password after validation, creates a session for the email-matched user, and returns the full database user; this is sample-source behavior, not evidence about generated applications.
- RPC logging defaults to verbose and preResolver logs input data; a password-bearing resolver can therefore reach logging unless configured otherwise. Actual log exposure was not tested.
- Resolver discovery recursively registers query/mutation files, and rpcHandler executes registered defaults without automatically inserting resolver.authorize; authorization must be supplied by application code or its middleware.
- App Router GET handling is a source-level inconsistency: the branch permits GET but unconditionally calls req.json() and reads query payload fields from route params. Bodyless GET support requires runtime verification.
- App Router RPC invokes resolvers with only {session}, whereas Pages RPC passes res.blitzCtx; custom context fields do not follow the same handler path.
- CSRF protection can be disabled by DANGEROUSLY_DISABLE_CSRF_PROTECTION, and secure-cookie defaults can be disabled by DISABLE_SECURE_COOKIES; these switches are security-sensitive configuration inputs.
- Core anonymous-session signing requires a production SESSION_SECRET_KEY of at least 32 characters, but OAuth cookie-session adapters directly include a default-dev-secret fallback; verify initialization and production configuration before assessing exposure.
- Hypothesis: password reset can leave partial state on failures or concurrent consumption because token lookup/deletion, password update, and session deletion are separate awaited database operations in the inspected function. (inferred)
- The sample forgotPasswordMailer throws in production and constructs an /auth/reset-password URL; its development preview is not evidence of production email delivery.
- codegenTasks writes into the resolved Next installation using version-dependent regex patches and logs caught errors; startup codegen has effects beyond application source files.
- AppGenerator postWrite retrieves dependency versions, installs packages, initializes Git, and can commit; newApp's post-install callback can migrate the database, so scaffolding is not a read-only inspection command.
- Session capabilities have explicit incomplete branches: advanced mode throws during creation, and RSC mutation methods log unsupported operations and return.
- NextAuthAdapter imports next-auth/core internals, and withBlitz locates/copies sodium-native prebuilds while swallowing copy-setup exceptions; both paths depend on external package layout.