# Risk map — sindresorhus/got

> Canonical page: https://codevetter.com/unpack/got/risk-map

# Risk map — sindresorhus/got

Scanned commit e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4 (2026-09-20). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Important boundaries include inherited credentials, redirect payload replay, diagnostic subscribers, local sockets, and caller-supplied transport settings. Async hooks and stream cleanup couple several request states, making seemingly small edits consequential. Buffering and a documented cache dependency limitation warrant targeted validation in a later execution-authorized task.
- Cross-origin 307/308 redirects intentionally preserve replayable bodies while removing inherited credentials; applications cannot equate credential stripping with preventing payload disclosure to a redirect destination. — [source/core/index.ts#L1301-L1326](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L1301-L1326) [test/redirects.ts#L1287-L1308](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/test/redirects.ts#L1287-L1308)
- allowAbsoluteUrls:false restricts explicit inputs with prefixUrl, but internal redirects temporarily permit resolved absolute URLs; Unix sockets are separately opt-in and redirects cannot switch socket paths. These controls have distinct scopes. — [source/core/options.ts#L1021-L1057](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/options.ts#L1021-L1057) [source/core/options.ts#L2147-L2159](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/options.ts#L2147-L2159) [source/core/index.ts#L1282-L1293](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L1282-L1293) [source/core/index.ts#L1332-L1339](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L1332-L1339)
- Diagnostic URLs have username/password removed, but request-start and response-start publications include full headers; subscribers therefore receive potentially sensitive Authorization, Cookie, or Set-Cookie values. — [source/core/utils/strip-url-auth.ts#L4-L8](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/utils/strip-url-auth.ts#L4-L8) [source/core/index.ts#L1646-L1652](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L1646-L1652) [source/core/index.ts#L1116-L1123](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L1116-L1123) [source/core/diagnostics-channel.ts#L109-L112](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/diagnostics-channel.ts#L109-L112)
- Hypothesis: large or highly compressed responses can impose substantial memory pressure in Promise mode because _setRawBody() materializes chunks and concatenated bytes, while text/JSON paths can also retain decoded strings; strictContentLength validates transferred length rather than a decoded-size ceiling. (inferred) — [source/core/index.ts#L1594-L1620](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L1594-L1620) [source/core/index.ts#L937-L947](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L937-L947) [source/core/index.ts#L1092-L1101](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L1092-L1101)
- timeout.request starts only once initial setup is complete, so an initial beforeRequest hook can outlast that configured budget; a dedicated regression test explicitly expects a 1500ms hook to succeed with a 1000ms request timeout. — [source/core/index.ts#L2516-L2520](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L2516-L2520) [source/core/index.ts#L2725-L2727](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L2725-L2727) [source/core/index.ts#L2353-L2364](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L2353-L2364) [test/request-timeout.ts#L113-L128](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/test/request-timeout.ts#L113-L128)
- Retry cleanup is tightly coupled to body identity: Request temporarily clears a replacement body during destroy(), preserves it for the next attempt, and asPromise rejects unchanged non-replayable bodies; incorrect ordering can destroy the replacement or reuse consumed input. — [source/core/index.ts#L625-L660](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/index.ts#L625-L660) [source/as-promise/index.ts#L220-L231](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/as-promise/index.ts#L220-L231) [source/core/utils/is-non-replayable-body.ts#L3-L9](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/utils/is-non-replayable-body.ts#L3-L9)
- HTTP/2 protocol/session identity includes certificate settings, rejectUnauthorized, checkServerIdentity, and lookup identity; removing these key components could defeat the separation that the checkServerIdentity regression test expects. (inferred) — [source/core/utils/http2-client.ts#L209-L233](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/utils/http2-client.ts#L209-L233) [source/core/utils/http2-client.ts#L319-L327](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/utils/http2-client.ts#L319-L327) [source/core/utils/http2-client.ts#L725-L728](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/source/core/utils/http2-client.ts#L725-L728) [test/https.ts#L2594-L2619](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/test/https.ts#L2594-L2619)
- test/cache.ts explicitly attributes dropped newly introduced 304 metadata to http-cache-semantics and marks the scenario test.failing; this is a documented source-level limitation, not a failure reproduced during this inspection. — [test/cache.ts#L1082-L1100](https://github.com/sindresorhus/got/blob/e1d87d2ced01d5b7d855a7dc8b091bf7b014a1e4/test/cache.ts#L1082-L1100)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)