# Risk map — vercel/turborepo

> Canonical page: https://codevetter.com/unpack/turborepo/risk-map

# Risk map — vercel/turborepo

Scanned commit 2540ee1d740bb96bf249459a7957ef4b380c9e43 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The following are security-sensitive boundaries and source-observed coupling points, not confirmed vulnerabilities. Native command execution, archive restoration, user-level credentials, remote cache authorization, and internal operator deployment protection deserve focused review. The bounded inspection does not establish whole-repository coverage or the absence of other risks.
- Task command configuration can replace native commands or opt out entirely; executable, arguments, cwd, and environment are applied before spawning, making repository task definitions an execution trust boundary. — [crates/turborepo-task-executor/src/command.rs#L254-323](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-task-executor/src/command.rs#L254-L323) [crates/turborepo-task-executor/src/exec.rs#L398-403](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-task-executor/src/exec.rs#L398-L403)
- Archive restore writes into the anchor and supports directories, regular files, and symlinks; Unix regular-file permissions are masked to 0777 and unsupported entry types fail. — [crates/turborepo-cache/src/cache_archive/restore.rs#L63-83](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-cache/src/cache_archive/restore.rs#L63-L83) [crates/turborepo-cache/src/cache_archive/restore.rs#L191-200](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-cache/src/cache_archive/restore.rs#L191-L200) [crates/turborepo-cache/src/cache_archive/restore_regular.rs#L35-61](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-cache/src/cache_archive/restore_regular.rs#L35-L61)
- Output collection follows symlinked output roots, filters peer managed logs, and rejects paths outside the repository; restoration currently fetches the artifact without using output globs to restrict extraction. — [crates/turborepo-run-cache/src/lib.rs#L639-647](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-run-cache/src/lib.rs#L639-L647) [crates/turborepo-run-cache/src/lib.rs#L783-821](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-run-cache/src/lib.rs#L783-L821)
- Login persists access and refresh tokens outside the repository through create_with_contents_secret; credential routing distinguishes vca_ tokens from legacy tokens and clears alternate storage. — [crates/turborepo-cli/src/commands/login/mod.rs#L145-182](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-cli/src/commands/login/mod.rs#L145-L182) [crates/turborepo-auth/src/lib.rs#L420-445](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-auth/src/lib.rs#L420-L445)
- Artifact signing uses TURBO_REMOTE_CACHE_SIGNATURE_KEY and binds hash, team ID, and body length; short-key enforcement is conditional, with warning-only compatibility unless longerSignatureKey is enabled. — [crates/turborepo-cache/src/signature_authentication.rs#L55-95](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-cache/src/signature_authentication.rs#L55-L95) [crates/turborepo-cache/src/http.rs#L78-87](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-cache/src/http.rs#L78-L87)
- Remote-cache token recovery is serialized and retries with changed credentials; failed recovery disables remote caching for the run, while task cache-fetch errors are logged before execution continues. — [crates/turborepo-cache/src/http.rs#L136-187](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-cache/src/http.rs#L136-L187) [crates/turborepo-task-executor/src/exec.rs#L362-381](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-task-executor/src/exec.rs#L362-L381)
- The GraphQL service binds 127.0.0.1:8000 and rejects Host values outside localhost/127.0.0.1, explicitly guarding its local HTTP exposure. — [crates/turborepo-query/src/server.rs#L17-51](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/crates/turborepo-query/src/server.rs#L17-L51)
- Factory documents Vercel Deployment Protection as its outer operator authentication layer and same-origin/action-header checks for mutations; deployment protection configuration is therefore a material access-control dependency. — [apps/factory/README.md#L3-3](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/apps/factory/README.md#L3-L3) [apps/factory/README.md#L37-42](https://github.com/vercel/turborepo/blob/2540ee1d740bb96bf249459a7957ef4b380c9e43/apps/factory/README.md#L37-L42)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)