# Risk map — effect-ts/effect

> Canonical page: https://codevetter.com/unpack/effect/risk-map

# Risk map — effect-ts/effect

Scanned commit 6389d9ac64c0f62ccc8b575fb9afc65fc104e814 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The inspected security-sensitive boundaries include credential handling, process execution, filesystem operations, native SQLite, dynamic compilation, and privileged CI. Several APIs intentionally expose caller-selected capabilities and therefore require appropriate consumer configuration. Two findings are explicitly labeled hypotheses requiring reproduction: concurrent schema-store modification and static-file symlink containment. None of these observations establishes a confirmed vulnerability or a repository-wide absence of safeguards.
- securityDecode extracts HTTP/API-key/Basic credentials and returns empty credentials for missing or malformed inputs; supplied security middleware determines acceptance. OpenAiClient separately reveals Redacted credentials to construct outbound headers and accepts a caller-selected apiUrl. — [packages/effect/src/http-api/HttpApiBuilder.ts#L546-L600](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/http-api/HttpApiBuilder.ts#L546-L600) [packages/effect/src/http-api/HttpApiBuilder.ts#L964-L984](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/http-api/HttpApiBuilder.ts#L964-L984) [packages/ai/openai/src/OpenAiClient.ts#L201-L227](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/ai/openai/src/OpenAiClient.ts#L201-L227)
- NodeChildProcessSpawner forwards command and argument arrays to node:child_process.spawn after resolving cwd, environment, and stdio; buildSpawnOptions also forwards options.shell. This is a host process-execution boundary controlled by consumer command construction. — [packages/platform/node-shared/src/NodeChildProcessSpawner.ts#L363-L388](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/platform/node-shared/src/NodeChildProcessSpawner.ts#L363-L388) [packages/platform/node-shared/src/NodeChildProcessSpawner.ts#L530-L544](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/platform/node-shared/src/NodeChildProcessSpawner.ts#L530-L544) [packages/platform/node-shared/src/internal/nodeChildProcessSpawner.ts#L4-L15](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/platform/node-shared/src/internal/nodeChildProcessSpawner.ts#L4-L15)
- Filesystem KeyValueStore rejects empty, dot, and dot-dot keys and percent-encodes filenames, but its clear operation recursively removes the entire supplied directory; the API documentation explicitly forbids sharing that directory with unrelated data. — [packages/effect/src/persistence/KeyValueStore.ts#L351-L360](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/persistence/KeyValueStore.ts#L351-L360) [packages/effect/src/persistence/KeyValueStore.ts#L373-L388](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/persistence/KeyValueStore.ts#L373-L388) [packages/effect/src/persistence/KeyValueStore.ts#L448-L455](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/persistence/KeyValueStore.ts#L448-L455)
- Node SQLite operations are synchronous and busy_timeout can block the event loop; the default is five seconds. The adapter also exposes caller-selected backup destinations and native extension loading, temporarily enabling extension support, while executeStream deliberately dies as unimplemented. — [packages/sql/sqlite-node/src/SqliteClient.ts#L95-L108](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/sql/sqlite-node/src/SqliteClient.ts#L95-L108) [packages/sql/sqlite-node/src/SqliteClient.ts#L143-L160](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/sql/sqlite-node/src/SqliteClient.ts#L143-L160) [packages/sql/sqlite-node/src/SqliteClient.ts#L273-L300](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/sql/sqlite-node/src/SqliteClient.ts#L273-L300)
- Hypothesis: concurrent SchemaStore.modify calls can lose updates because modify performs get, an application transform, and set without a transaction or lock in this wrapper. Backend-specific or caller synchronization must be examined before treating it as atomic. (inferred) — [packages/effect/src/persistence/KeyValueStore.ts#L801-L813](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/persistence/KeyValueStore.ts#L801-L813)
- Hypothesis: static-file symlinks may escape the configured root because resolveFilePath enforces lexical normalized-path containment, then serving uses filesystem.stat on that path. Realpath containment is not established by the inspected functions; exploitability depends on filesystem behavior and writable tree contents. (inferred) — [packages/effect/src/http/HttpStaticServer.ts#L182-L203](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/http/HttpStaticServer.ts#L182-L203) [packages/effect/src/http/HttpStaticServer.ts#L382-L402](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/http/HttpStaticServer.ts#L382-L402)
- Schema JIT uses globalThis.Function and a module-level compiler registry. Blocked dynamic construction or compilation failures retain interpretation, but previously captured parser entries are not replaced, making installation order an explicit behavioral constraint. — [packages/effect/src/schema/SchemaJITCompiler.ts#L21-L50](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/schema/SchemaJITCompiler.ts#L21-L50) [packages/effect/src/schema/SchemaJITCompiler.ts#L71-L85](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/schema/SchemaJITCompiler.ts#L71-L85) [packages/effect/src/internal/schema/compilerRegistry.ts#L180-L214](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/internal/schema/compilerRegistry.ts#L180-L214) [packages/effect/src/schema/SchemaJITCompiler/enable.ts#L1-L13](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/packages/effect/src/schema/SchemaJITCompiler/enable.ts#L1-L13)
- Privileged CI deserves separate review: release-queue uses pull_request_target, checks out PRs after its fork environment gate, and grants write permissions; snapshot also gates forks. Bundle-comment consumes untrusted artifacts with symlink, size, line-count, and format validation before writing comments. — [.github/workflows/release-queue.yml#L3-L37](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/.github/workflows/release-queue.yml#L3-L37) [.github/workflows/snapshot.yml#L16-L29](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/.github/workflows/snapshot.yml#L16-L29) [.github/workflows/bundle-comment.yml#L19-L69](https://github.com/effect-ts/effect/blob/6389d9ac64c0f62ccc8b575fb9afc65fc104e814/.github/workflows/bundle-comment.yml#L19-L69)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)