# Risk map — blitz-js/blitz

> Canonical page: https://codevetter.com/unpack/blitz/risk-map

# Risk map — blitz-js/blitz

Scanned commit b18f81873e641934043f791fec06e22f5fe5a86e (2025-09-11). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly identified hypotheses, not confirmed vulnerabilities. The highest-impact boundaries are resolver exposure, authentication state, logging, and CLI filesystem/process side effects. Example applications contain behavior that differs materially from generated templates. Separate Pages and App Router implementations and upstream-internal imports create maintenance and verification obligations.
- The toolkit-app default login has authenticateUser commented out, ignores password after validation, creates a session for the email-matched user, and returns the full database user; this is sample-source behavior, not evidence about generated applications. — [apps/toolkit-app/src/auth/mutations/login.ts#L25-32](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/login.ts#L25-L32) [packages/generator/templates/app/src/app/auth/mutations/login.ts#L8-28](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/templates/app/src/app/auth/mutations/login.ts#L8-L28)
- RPC logging defaults to verbose and preResolver logs input data; a password-bearing resolver can therefore reach logging unless configured otherwise. Actual log exposure was not tested. — [packages/blitz-rpc/src/rpc-logger.ts#L19-35](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/rpc-logger.ts#L19-L35) [packages/blitz-rpc/src/rpc-logger.ts#L133-144](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/rpc-logger.ts#L133-L144) [packages/blitz-rpc/src/index-server.ts#L301-306](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L301-L306)
- Resolver discovery recursively registers query/mutation files, and rpcHandler executes registered defaults without automatically inserting resolver.authorize; authorization must be supplied by application code or its middleware. — [packages/blitz-rpc/src/server/loader/server/loader-server.ts#L116-156](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/server/loader-server.ts#L116-L156) [packages/blitz-rpc/src/index-server.ts#L261-304](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L261-L304) [packages/blitz-rpc/src/server/resolvers/resolver.ts#L277-291](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/resolvers/resolver.ts#L277-L291)
- App Router GET handling is a source-level inconsistency: the branch permits GET but unconditionally calls req.json() and reads query payload fields from route params. Bodyless GET support requires runtime verification. — [packages/blitz-rpc/src/index-server.ts#L367-375](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L367-L375) [packages/blitz-rpc/src/index-server.ts#L401-425](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L401-L425) [packages/blitz-rpc/src/client/rpc.ts#L77-80](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L77-L80)
- App Router RPC invokes resolvers with only {session}, whereas Pages RPC passes res.blitzCtx; custom context fields do not follow the same handler path. — [packages/blitz-rpc/src/index-server.ts#L304-304](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L304-L304) [packages/blitz-rpc/src/index-server.ts#L428-430](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L428-L430) [packages/blitz-next/src/index-server.ts#L165-168](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L165-L168)
- CSRF protection can be disabled by DANGEROUSLY_DISABLE_CSRF_PROTECTION, and secure-cookie defaults can be disabled by DISABLE_SECURE_COOKIES; these switches are security-sensitive configuration inputs. — [packages/blitz-auth/src/server/auth-sessions.ts#L784-788](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L784-L788) [packages/blitz-auth/src/server/auth-plugin.ts#L73-79](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L73-L79)
- Core anonymous-session signing requires a production SESSION_SECRET_KEY of at least 32 characters, but OAuth cookie-session adapters directly include a default-dev-secret fallback; verify initialization and production configuration before assessing exposure. — [packages/blitz-auth/src/server/auth-sessions.ts#L608-627](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L608-L627) [packages/blitz-auth/src/server/adapters/passport/adapter.ts#L38-41](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/passport/adapter.ts#L38-L41) [packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L67-70](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L67-L70)
- Hypothesis: password reset can leave partial state on failures or concurrent consumption because token lookup/deletion, password update, and session deletion are separate awaited database operations in the inspected function. (inferred) — [apps/toolkit-app/src/auth/mutations/resetPassword.ts#L14-46](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/resetPassword.ts#L14-L46)
- The sample forgotPasswordMailer throws in production and constructs an /auth/reset-password URL; its development preview is not evidence of production email delivery. — [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L13-16](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L13-L16) [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L32-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L32-L42)
- codegenTasks writes into the resolved Next installation using version-dependent regex patches and logs caught errors; startup codegen has effects beyond application source files. — [packages/blitz/src/cli/utils/codegen-tasks.ts#L17-29](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/codegen-tasks.ts#L17-L29) [packages/blitz/src/cli/utils/codegen-tasks.ts#L31-71](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/codegen-tasks.ts#L31-L71)
- AppGenerator postWrite retrieves dependency versions, installs packages, initializes Git, and can commit; newApp's post-install callback can migrate the database, so scaffolding is not a read-only inspection command. — [packages/generator/src/generators/app-generator.ts#L128-178](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L128-L178) [packages/generator/src/generators/app-generator.ts#L298-309](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L298-L309) [packages/blitz/src/cli/commands/new.ts#L239-252](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/new.ts#L239-L252)
- Session capabilities have explicit incomplete branches: advanced mode throws during creation, and RSC mutation methods log unsupported operations and return. — [packages/blitz-auth/src/server/auth-sessions.ts#L486-526](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L486-L526) [packages/blitz-auth/src/server/auth-sessions.ts#L539-543](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L539-L543) [packages/blitz-auth/src/server/auth-sessions.ts#L1035-1040](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1035-L1040)
- NextAuthAdapter imports next-auth/core internals, and withBlitz locates/copies sodium-native prebuilds while swallowing copy-setup exceptions; both paths depend on external package layout. — [packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L18-34](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L18-L34) [packages/blitz-next/src/index-server.ts#L280-302](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L280-L302)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)