CodeVetter · Repo Unpack · Risk map
remix-run/remix
The inspected security-sensitive boundaries include proxy-derived URLs, browser-accessible source, raw HTML, OAuth/session state, filesystem writes, and subprocess module loading. Several protections are explicit, including signed-session requirements, callback state checks, return-path normalization, and header reduction for cross-origin frames. Backend limitations and application configuration remain important to the security model. These are source observations and labeled hypotheses, not confirmed vulnerabilities or a complete security audit.
- trustProxy allows Forwarded and X-Forwarded headers to affect request host, protocol, and client address; its documented precondition is a trusted proxy that overwrites those headers.
- Browser asset exposure is an explicit policy boundary: the template allows routes.ts and public descendants, allows the remix package, denies test files, and configures mounts outside its root for monorepo use.
- Injected asset-runtime files are allowed before configured allow/deny matching, while ordinary allowed files can subsequently be denied; policy changes must preserve this intentional exception.
- HostProps.innerHTML accepts UnsafeHTML and explicitly performs no sanitization; untrusted content passed through this API is an application-owned trust decision.
- The default browser frame resolver restricts fetch to same-origin mode but does not sanitize HTML; custom resolvers own request, redirect, and content trust policies.
- Server frame resolution removes body/transport headers, strips sec-fetch headers, limits redirects to 20, and uses a reduced header allowlist when the frame URL changes origin.
- OAuth callback processing validates stored provider and state and clears the transaction after success or failure; returnTo normalization rejects nonlocal origins and double-slash paths.
- OAuthTransaction.providerState documentation requires providers to encrypt sensitive values because session storage does not guarantee confidentiality.
- Cookie session storage serializes all session data into JSON and explicitly warns that regenerated old session IDs cannot be deleted; session rotation therefore has different revocation properties across storage backends.
- Session middleware requires signed cookies and defaults HTTP-only/Secure, but honors explicit insecure overrides; Secure otherwise depends on the interpreted request protocol.
- Scaffolding writes to a user-resolved target directory outside any fixed repository boundary; --force permits a nonempty directory and template copying overwrites matching files.
- Route inspection executes application module code in a child process through dynamic import; process separation is not a sandbox for an untrusted checkout. (inferred)
- Hypothesis: concurrent first logins for one external identity could require transaction or uniqueness guarantees elsewhere, because the inspected resolver performs lookup, user creation, and account creation as separate awaited operations without an enclosing transaction in this function. (inferred)
- CI integration selection contains references to standalone integration-workflow paths while the inspected jobs are embedded in check-pr/check-main; edits to filtering or shared middleware merit checking whether integration jobs are selected. (inferred)
- The automatic formatting workflow checks out with FORMAT_PAT and can commit/push changes on main; generated agentic workflows also expose write-capable automation, making workflow edits a privileged boundary.