CodeVetter · Repo Unpack · Risk map
colinhacks/zod
The core library has no authentication, database, or arbitrary filesystem surface, but it processes untrusted values and generates executable validation functions, so correctness and denial-of-service behavior are security-relevant. The code contains explicit mitigations for prototype pollution, cycles, ReDoS-prone formats, CSP restrictions, and duplicated callback execution. The documentation and automation layers introduce the repository's network, filesystem, token, and privileged CI boundaries. The largest maintenance risk is semantic drift among interpreted parsing, object JIT, AOT compilation, JSON Schema generation, classic, and mini surfaces.
- AOT compilation uses the `Function` constructor and is incompatible with strict no-eval CSPs; global mode honors `config({jitless:true})`, while an explicit `z.compile()` call is treated as deliberate opt-in.
- Generated code receives user callbacks as hoisted constants rather than interpolating their source, but those callbacks can throw or return promises and force the compiler to weaken its definitive-rejection guarantee or refuse compilation.
- On invalid compiled inputs, refinements and transforms may execute twice—once in the fast path and once in interpreter fallback—so user callbacks should not rely on exactly-once side effects.
- `z.jwt()` is a structural validator only: it splits three segments, decodes and parses the header, checks `typ` and `alg`, but performs no signature, issuer, audience, expiration, or claims verification.
- Prototype-pollution defenses are load-bearing: object parsing strips undeclared `__proto__`, compiled records recheck transformed keys, and `assignProp` uses `Object.defineProperty` so hostile property names become own data properties.
- Recursive object graphs are supported only through the memoized runtime path; cycles through transforms throw `$ZodCyclicError`, and AOT compilation refuses recursive schema subtrees because generated functions do not receive the parse context.
- `fromJSONSchema` rejects external references and normalizes input with a JSON round-trip; this bounds traversal to JSON data but also means cyclic JavaScript objects, getters, proxies, class identity, and non-JSON values cannot be preserved.
- The docs build sends a server-side `GITHUB_TOKEN` to GitHub GraphQL to obtain ecosystem star counts, retries failures, and intentionally fails production builds if the integration cannot supply data.
- Inkeep search and chat execute in client components using `NEXT_PUBLIC_INKEEP_KEY`; the variable is intentionally browser-visible and must not be treated as a private server credential.
- The Pullfrog workflow combines repository and issue write permissions with a broad set of model-provider secrets, making the third-party agent action a high-blast-radius CI trust boundary.
- Publishing has write access to repository contents and OIDC, but is constrained to a manually dispatched npm environment with required approval, full prepublish checks, package availability polling, and provenance-enabled publishing.
- Shared semantic changes have unusually high blast radius because interpreted containers, optionality rules, object JIT, AOT code generation, JSON Schema processors, classic, and mini must agree on key presence, output construction, and failure behavior. (inferred)