# Risk map — meteor/meteor

> Canonical page: https://codevetter.com/unpack/meteor/risk-map

# Risk map — meteor/meteor

Scanned commit ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e (2026-09-22). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include executable downloads, prototype permissions, authentication transport, network-facing DDP handlers, child processes, and generated filesystem output. The inspection also found a concrete limitation in two authorization test assertions.
- Source-checkout startup may download/extract a dependency kit and replace dev_bundle when missing or version-mismatched; this is an executable-download and filesystem-replacement boundary. — [meteor#L85-100](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/meteor#L85-L100) [meteor#L108-118](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/meteor#L108-L118)
- create --prototype explicitly inserts autopublish and insecure; server mutations can then bypass collection validators, and automatic publications expose collection cursors unless prevented. — [tools/cli/commands.js#L1256-1270](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/commands.js#L1256-L1270) [packages/allow-deny/allow-deny.js#L197-224](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/allow-deny/allow-deny.js#L197-L224) [packages/mongo/collection/collection_utils.js#L36-44](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/mongo/collection/collection_utils.js#L36-L44)
- The password handler accepts plaintext strings as well as SHA-256 digest objects and explicitly states that neither transport option is secure without SSL. — [packages/accounts-password/password_server.js#L299-311](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-password/password_server.js#L299-L311) [packages/accounts-password/password_server.js#L55-66](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-password/password_server.js#L55-L66)
- DDP method and subscription rate-limit enforcement is conditional on the ddp-rate-limiter package being present; inspected transport handlers do not unconditionally apply that limiter. — [packages/ddp-server/livedata_server.js#L528-545](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/ddp-server/livedata_server.js#L528-L545) [packages/ddp-server/livedata_server.js#L635-658](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/ddp-server/livedata_server.js#L635-L658)
- AppProcess spawns Node with computed environment, optional inspector settings, and an IPC pipe, then enables inter-process messaging; changes here affect process and diagnostic exposure boundaries. — [tools/runners/run-app.js#L339-377](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/runners/run-app.js#L339-L377)
- Project-local output can be redirected by METEOR_LOCAL_DIR, and build output uses the resolved user destination; building under the source tree only emits a warning because generated files may be interpreted as source. — [tools/project-context.js#L173-183](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/project-context.js#L173-L183) [tools/cli/commands.js#L1513-1533](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/commands.js#L1513-L1533)
- Hypothesis: changes to password hash configuration or asynchronous rehash scheduling could affect authentication compatibility because checkPasswordAsync supports both bcrypt-to-Argon2 migration and Argon2-to-bcrypt rollback after successful verification. (inferred) — [packages/accounts-password/password_server.js#L217-274](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-password/password_server.js#L217-L274) [packages/accounts-password/password_argon_tests.js#L1-40](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-password/password_argon_tests.js#L1-L40)
- The inspected partial-allow and partial-deny tests assert 403 only inside catch blocks; a resolved update reaches the end without an explicit rejection assertion, limiting those two cases' ability to detect authorization regressions. — [packages/mongo/tests/allow_tests.js#L304-337](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/mongo/tests/allow_tests.js#L304-L337)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)