# Risk map — redwoodjs/redwood

> Canonical page: https://codevetter.com/unpack/redwood/risk-map

# Risk map — redwoodjs/redwood

Scanned commit a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd (2025-12-13). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The observations below identify security-sensitive boundaries and correctness hotspots in source, not confirmed vulnerabilities. Authentication and filesystem APIs rely on application configuration and authorization decisions, while dynamic module loading trusts installed or compiled code. Several explicit comments document unfinished behavior, including CSRF validation and job runtime enforcement. Runtime severity, exploitability, and whole-repository coverage remain unverified.
- DbAuthHandler._validateCsrf compares the session token to the request header but is explicitly labeled 'not used yet'; login responses nevertheless issue a CSRF token and encrypted session cookie. — [packages/auth-providers/dbAuth/api/src/DbAuthHandler.ts#L1255-1263](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/auth-providers/dbAuth/api/src/DbAuthHandler.ts#L1255-L1263) [packages/auth-providers/dbAuth/api/src/DbAuthHandler.ts#L1525-1536](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/auth-providers/dbAuth/api/src/DbAuthHandler.ts#L1525-L1536)
- useRequireAuth catches authentication errors, clears currentUser, and still calls handlerFn; its development warning instructs applications to call requireAuth inside their own handlers. — [packages/graphql-server/src/functions/useRequireAuth.ts#L59-78](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/graphql-server/src/functions/useRequireAuth.ts#L59-L78)
- The Lambda GraphQL wrapper logs execution exceptions and returns an error body with statusCode 200, accompanied by a source comment saying it should be 500. — [packages/graphql-server/src/functions/graphql.ts#L125-134](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/graphql-server/src/functions/graphql.ts#L125-L134)
- Worker awaits Executor.perform in-process and explicitly leaves maxRuntime timeout enforcement as a TODO requiring a separate process; maxRuntime is currently passed to adapter.find. — [packages/jobs/src/core/Worker.ts#L181-198](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/jobs/src/core/Worker.ts#L181-L198)
- FileSystemStorage.read/remove accept caller-supplied paths directly, and save accepts a path override; these methods contain no local check confining operations to baseDir. — [packages/storage/src/adapters/FileSystemStorage/FileSystemStorage.ts#L24-45](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/storage/src/adapters/FileSystemStorage/FileSystemStorage.ts#L24-L45)
- CLI plugin auto-install defaults to true, and loadPluginPackage can install and dynamically import a configured package; the source also notes installed/requested version mismatch handling is incomplete. — [packages/project-config/src/config.ts#L183-192](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/project-config/src/config.ts#L183-L192) [packages/cli/src/lib/plugin.js#L180-204](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/cli/src/lib/plugin.js#L180-L204)
- Vite publishes explicitly included and REDWOOD_ENV_ prefixed environment values in browser definitions and HTML substitutions; naming/configuration determines which values cross the server-to-browser boundary. — [packages/vite/src/lib/envVarDefinitions.ts#L29-53](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/vite/src/lib/envVarDefinitions.ts#L29-L53) [packages/vite/src/index.ts#L95-109](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/vite/src/index.ts#L95-L109)
- lambdaLoader keys imported functions by basename and assigns them into a shared registry; hypothesis: two discovered files with the same basename could collide, which should be checked before changing discovery rules. (inferred) — [packages/api-server/src/plugins/lambdaLoader.ts#L18-48](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/api-server/src/plugins/lambdaLoader.ts#L18-L48) [packages/api-server/src/plugins/lambdaLoader.ts#L103-113](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/api-server/src/plugins/lambdaLoader.ts#L103-L113)
- Fastify server setup imports a Babel-generated __rw_graphqlOptions export from the application's compiled GraphQL function; this creates a coupling between the build transform and runtime registration. — [packages/api-server/src/createServer.ts#L128-145](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/api-server/src/createServer.ts#L128-L145) [packages/api-server/src/plugins/graphql.ts#L46-57](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/api-server/src/plugins/graphql.ts#L46-L57)
- The todo fixture retains a GraphQL bootstrap importing makeServices/makeMergedSchema from @redwoodjs/api and passing schema, whereas test-project uses @redwoodjs/graphql-server with sdls/services/loggerConfig; it should not be treated as a current server setup recipe. — [__fixtures__/example-todo-main/api/src/functions/graphql.js#L1-19](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/__fixtures__/example-todo-main/api/src/functions/graphql.js#L1-L19) [__fixtures__/test-project/api/src/functions/graphql.ts#L1-24](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/__fixtures__/test-project/api/src/functions/graphql.ts#L1-L24)
- UrlSigner deliberately supports nonexpiring signatures when no expiresInMs is supplied and compares signatures with ordinary string inequality; expiration and comparison behavior are review points at this access boundary. — [packages/storage/src/UrlSigner.ts#L39-58](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/storage/src/UrlSigner.ts#L39-L58) [packages/storage/src/UrlSigner.ts#L84-98](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/storage/src/UrlSigner.ts#L84-L98)
- Job loaders join stored jobPath to the compiled jobs directory and dynamically import the result; protecting persisted invocation metadata is consequently part of the worker's code-execution trust boundary. — [packages/jobs/src/loaders.ts#L44-62](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/jobs/src/loaders.ts#L44-L62) [packages/jobs/src/adapters/PrismaAdapter/PrismaAdapter.ts#L185-189](https://github.com/redwoodjs/redwood/blob/a7852fb92d0e4ac2bcce1d9a755717ba6cf53ffd/packages/jobs/src/adapters/PrismaAdapter/PrismaAdapter.ts#L185-L189)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)