# Risk map — keystonejs/keystone

> Canonical page: https://codevetter.com/unpack/keystone/risk-map

# Risk map — keystonejs/keystone

Scanned commit 1a8f2b7fae39ea5dac415745caea4f766109e669 (2026-09-14). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The main sensitive boundaries are privileged context APIs, authentication/session configuration, external storage, and commands that generate files or alter databases. Source inspection also reveals example/API drift and a Cloudinary metadata mapping concern. These findings are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities or executed defect reproductions.
- sudo() constructs an internal context with permission bypass enabled, while internal() only changes schema scope; direct Prisma access is exposed separately and the actions example explicitly uses it to bypass Keystone access checks. — [packages/core/src/lib/context/createContext.ts#L79-85](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/context/createContext.ts#L79-L85) [packages/core/src/lib/context/createContext.ts#L123-132](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/context/createContext.ts#L123-L132) [packages/core/src/lib/core/access-control.ts#L93-109](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/access-control.ts#L93-L109) [examples/actions/schema.ts#L68-81](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/examples/actions/schema.ts#L68-L81)
- Admin UI access defaults to allowed when no session strategy exists; server.cors=true becomes reflected origins with credentials=true. These configuration choices must be assessed independently of list API permissions. — [packages/core/src/schema.ts#L111-114](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/schema.ts#L111-L114) [packages/core/src/schema.ts#L128-134](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/schema.ts#L128-L134) [packages/core/src/schema.ts#L182-189](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/schema.ts#L182-L189) [packages/core/src/lib/express.ts#L64-69](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/express.ts#L64-L69)
- Hypothesis: omitting a stable session secret can invalidate sessions after strategy reconstruction or across independently initialized instances, because statelessSessions() generates a fresh random default secret. (inferred) — [packages/core/src/session.ts#L73-98](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/session.ts#L73-L98) [packages/core/src/session.ts#L116-133](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/session.ts#L116-L133)
- Hypothesis: a successful storage.put() followed by validation or database failure can leave an orphaned asset, because upload occurs during input resolution and the inspected cleanup hook addresses replaced/deleted old filenames after persistence. (inferred) — [packages/core/src/fields/types/file/index.ts#L65-81](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/fields/types/file/index.ts#L65-L81) [packages/core/src/fields/types/file/index.ts#L95-109](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/fields/types/file/index.ts#L95-L109) [packages/core/src/lib/core/mutations/index.ts#L597-619](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/mutations/index.ts#L597-L619) [packages/core/src/lib/core/mutations/index.ts#L94-102](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/mutations/index.ts#L94-L102)
- CLI operations have filesystem/database side effects: dev defaults to dbPush=true, Prisma helpers spawn the resolved CLI and use temporary directories, and artifact destinations can be configured through resolved paths. — [packages/core/src/scripts/cli.ts#L76-83](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/scripts/cli.ts#L76-L83) [packages/core/src/scripts/dev.ts#L150-169](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/scripts/dev.ts#L150-L169) [packages/core/src/lib/prisma-cli.ts#L11-19](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/prisma-cli.ts#L11-L19) [packages/core/src/lib/system.ts#L24-43](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/system.ts#L24-L43)
- The magic-link example reads password.extensions.keystoneSecretField and calls generateHash(), whereas current core exports extensions.keystoneKDF with hash()/compare(); the source names disagree on its token redemption path. — [examples/auth-magic-link/schema.ts#L165-181](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/examples/auth-magic-link/schema.ts#L165-L181) [packages/core/src/fields/types/password/index.ts#L54-57](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/fields/types/password/index.ts#L54-L57) [packages/core/src/fields/types/password/index.ts#L218-240](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/fields/types/password/index.ts#L218-L240)
- Cloudinary output maps both width and height from _meta.width, and the field implementation explicitly notes no delete support; dimension reporting and remote asset cleanup warrant focused review. — [packages/cloudinary/src/index.ts#L119-123](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/cloudinary/src/index.ts#L119-L123) [packages/cloudinary/src/index.ts#L183-192](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/cloudinary/src/index.ts#L183-L192)
- The document site can build with TypeScript errors ignored; root tsc excludes docs, and the inspected main types job runs recursive check plus root tsc, while docs/package.json has no check script. — [docs/next.config.mjs#L11-15](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/docs/next.config.mjs#L11-L15) [tsconfig.json#L19-20](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/tsconfig.json#L19-L20) [.github/workflows/tests_ci.yml#L38-50](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/.github/workflows/tests_ci.yml#L38-L50) [docs/package.json#L7-17](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/docs/package.json#L7-L17)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)