# Risk map — chromaui/chromatic-cli

> Canonical page: https://codevetter.com/unpack/chromatic-cli/risk-map

# Risk map — chromaui/chromatic-cli

Scanned commit 9e2606a2dbc11bcd07e7e451431432e32de0224b (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include credential exchange, shell command construction, repository mutation, filesystem traversal, and diagnostic uploads. Compatibility hotspots include shared Context access and persistent hash contracts across CLI versions. Mock-based tests provide useful behavioral specifications but do not validate these boundaries against a live service or real user workspace in this investigation.
- execGit uses shell:true while Git helpers interpolate revisions, branch references, and paths into command strings; findMergeBase and checkout therefore require careful input/escaping review at callers. No exploit was tested. — [node-src/git/execGit.ts#L14-L18](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/git/execGit.ts#L14-L18) [node-src/git/execGit.ts#L42-L50](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/git/execGit.ts#L42-L50) [node-src/git/git.ts#L394-L427](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/git/git.ts#L394-L427)
- Patch restoration executes git reset --hard before and after dependency installation; preparation checks a clean workspace, but isUpToDate returns true on remote-update or revision lookup errors, and restoration failures are logged without masking the original pipeline error. — [node-src/tasks/restoreWorkspace.ts#L15-L20](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/tasks/restoreWorkspace.ts#L15-L20) [node-src/git/git.ts#L300-L328](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/git/git.ts#L300-L328) [node-src/git/git.ts#L522-L524](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/git/git.ts#L522-L524) [node-src/index.ts#L393-L407](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/index.ts#L393-L407)
- Interactive checkPackageJson builds a persisted npm script from originalArgv.join(' '); if a project token was supplied on argv, the resulting package.json script can retain it. This path is gated by interactive mode and confirmation. — [node-src/lib/checkPackageJson.ts#L24-L39](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/checkPackageJson.ts#L24-L39) [node-src/lib/getOptions.ts#L71-L81](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/getOptions.ts#L71-L81) [node-src/index.ts#L252-L254](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/index.ts#L252-L254)
- TurboSnap enables metadata upload by default once a build Storybook URL exists; the upload list includes logs, diagnostics, main/preview configuration, trimmed stats, and the manifest. Diagnostics redact three named token fields, but that redaction is not applied by uploadMetadataFiles to every listed file. — [node-src/index.ts#L286-L296](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/index.ts#L286-L296) [node-src/lib/uploadMetadataFiles.ts#L36-L59](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/uploadMetadataFiles.ts#L36-L59) [node-src/lib/writeChromaticDiagnostics.ts#L57-L60](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/writeChromaticDiagnostics.ts#L57-L60)
- readMainConfig first evaluates the project's main configuration through require before falling back to AST parsing; metadata discovery is consequently a code-execution boundary, even before the explicit Storybook build command. — [node-src/lib/getStorybookMetadata.ts#L223-L251](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/getStorybookMetadata.ts#L223-L251) [node-src/lib/getStorybookMetadata.ts#L264-L273](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/getStorybookMetadata.ts#L264-L273) [node-src/index.ts#L364-L366](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/index.ts#L364-L366)
- Artifact enumeration uses statSync, which follows symlinks, without the ancestor-cycle tracking present in the v2 ProjectFiles tree walker; user-selected output/config/static paths can consequently involve filesystem locations beyond a repository-local artifact tree. — [node-src/tasks/prepare/validateFiles.ts#L45-L63](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/tasks/prepare/validateFiles.ts#L45-L63) [node-src/lib/turbosnap/v2/projectFiles.ts#L182-L228](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/turbosnap/v2/projectFiles.ts#L182-L228) [node-src/lib/getOptions.ts#L159-L162](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/getOptions.ts#L159-L162)
- Hypothesis: a build that never receives completion may wait indefinitely during snapshot monitoring. The inspected GraphQL completion loop has delay-and-recurse behavior without a local deadline or abort check, and the notify function accepts no AbortSignal; this was not reproduced. (inferred) — [node-src/tasks/snapshot.ts#L132-L157](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/tasks/snapshot.ts#L132-L157) [node-src/lib/waitForBuildToComplete.ts#L10-L16](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/waitForBuildToComplete.ts#L10-L16) [node-src/lib/waitForBuildToComplete.ts#L94-L105](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/waitForBuildToComplete.ts#L94-L105)
- Upload and TurboSnap preparation still thread the live Context through nominal task seams, and share stubs ctx.git with empty values; meanwhile v2 hash recipes persist across backend baselines. These are concrete coupling and compatibility hotspots for seemingly local refactors. — [node-src/tasks/upload.ts#L12-L16](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/tasks/upload.ts#L12-L16) [node-src/tasks/prepare/index.ts#L12-L15](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/tasks/prepare/index.ts#L12-L15) [node-src/share.ts#L65-L68](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/share.ts#L65-L68) [node-src/lib/turbosnap/v2/manifest.golden.test.ts#L12-L28](https://github.com/chromaui/chromatic-cli/blob/9e2606a2dbc11bcd07e7e451431432e32de0224b/node-src/lib/turbosnap/v2/manifest.golden.test.ts#L12-L28)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)