# Risk map — remeda/remeda

> Canonical page: https://codevetter.com/unpack/remeda/risk-map

# Risk map — remeda/remeda

Scanned commit 9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The most consequential source boundaries are dynamic utility dispatch, declaration rewriting, browser-loaded dependencies, HTML insertion, and agent hooks that execute commands or write files. These observations do not establish vulnerabilities. Two plausible behavior or maintenance risks are explicitly identified as hypotheses requiring verification. Browser interactions have less executable evidence than the library because the docs package documents no tests.
- purry explicitly describes itself as dynamically typed and depends on fn.length for dispatch; changing implementation arity can therefore alter both calling styles across utilities that delegate to it. — [packages/remeda/src/purry.ts#L8-L19](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/remeda/src/purry.ts#L8-L19) [packages/remeda/src/purry.ts#L46-L65](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/remeda/src/purry.ts#L46-L65) [packages/remeda/src/map.ts#L53-L60](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/remeda/src/map.ts#L53-L60)
- randomString uses Math.random to select alphanumeric characters and explicitly warns that it is not cryptographically secure; using it for authentication tokens would violate its documented capability. — [packages/remeda/src/randomString.ts#L6-L10](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/remeda/src/randomString.ts#L6-L10) [packages/remeda/src/randomString.ts#L43-L49](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/remeda/src/randomString.ts#L43-L49)
- Hypothesis: the website console sandbox can differ from the locally built documentation API because every base page loads sandbox.js, which imports an unversioned remeda module from esm.sh rather than the workspace artifact. (inferred) — [packages/docs/src/layouts/base.astro#L67-L68](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/docs/src/layouts/base.astro#L67-L68) [packages/docs/public/sandbox.js#L1-L9](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/docs/public/sandbox.js#L1-L9) [packages/docs/src/content/functions/content.config.ts#L8-L15](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/docs/src/content/functions/content.config.ts#L8-L15)
- Hypothesis: system-preference changes mishandle theme overrides because initTheme's change listener enables dark mode when a stored choice exists, whereas initial selection follows the media query only when storage is absent; no browser reproduction was performed. (inferred) — [packages/docs/src/lib/theme.ts#L10-L24](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/docs/src/lib/theme.ts#L10-L24) [packages/docs/src/lib/theme.ts#L28-L45](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/docs/src/lib/theme.ts#L28-L45)
- Declaration postprocessing relies on regex extraction and an export-statement insertion pattern; it throws when polyfills or an insertion point are missing and also rewrites Unicode separators for older TypeScript compatibility. — [packages/remeda/tsdown.config.ts#L24-L31](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/remeda/tsdown.config.ts#L24-L31) [packages/remeda/tsdown.config.ts#L137-L184](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/remeda/tsdown.config.ts#L137-L184) [packages/remeda/tsdown.config.ts#L198-L214](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/remeda/tsdown.config.ts#L198-L214)
- Markdown rendering crosses an explicit set:html boundary protected by marked-to-DOMPurify sanitization; the docs package documents no tests, so this inspection does not establish sanitization regression coverage. — [packages/docs/src/components/markdown.astro#L8-L12](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/docs/src/components/markdown.astro#L8-L12) [packages/docs/src/lib/as-html.ts#L9-L18](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/docs/src/lib/as-html.ts#L9-L18) [packages/docs/AGENTS.md#L19-L21](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/packages/docs/AGENTS.md#L19-L21)
- Agent stop hooks execute commands through spawnSync with inherited process environment and snapshot dirty files beneath an OS temporary directory; CLAUDE_PROJECT_DIR supplies package-root resolution, making this tooling a separate execution and filesystem boundary. — [.claude/hooks/lib/stop-handlers.ts#L17-L23](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/.claude/hooks/lib/stop-handlers.ts#L17-L23) [.claude/hooks/lib/stop-handlers.ts#L104-L127](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/.claude/hooks/lib/stop-handlers.ts#L104-L127) [.claude/hooks/lib/stop-handlers.ts#L254-L266](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/.claude/hooks/lib/stop-handlers.ts#L254-L266) [.claude/hooks/lib/path.ts#L4-L14](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/.claude/hooks/lib/path.ts#L4-L14)
- The post-edit formatter reads and rewrites tool_input.file_path after existence and parser checks; this handler contains no explicit repository-root containment check, so its allowed write boundary depends on the host tool and environment. — [.claude/hooks/post-edit-prettier.ts#L12-L45](https://github.com/remeda/remeda/blob/9955bb0eca98cc5d1bbb17dc4314dd38a10a28d5/.claude/hooks/post-edit-prettier.ts#L12-L45)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)