Hidden Assumptions in payload

12 assumptions this code never checks · 5 critical · spanning Domain, Shape, Contract, Temporal, Environment, Scale, Resource, Ordering

Every codebase relies on things it never checks. Most of them are routine. CodeSea looked at payloadcms/payload and picked out the few most likely to cause trouble. The full list is just below.

Most of what this code assumes is routine. These 3 are the ones most likely to cause trouble here. The rest are minor; they're under "Show everything".

Worth your attention first

If SAFE_STRING_REGEX is too restrictive, legitimate user data gets rejected with 400 errors. If too permissive, SQL injection vulnerabilities slip through the sanitization

Worth your attention first

If pathSegments is empty, pathSegments.slice(1) works but fullPath becomes '$[*]' and pathSegments.length === 1 check fails, generating malformed JSON path queries

Worth your attention first

If initialization code paths don't call these callbacks, API requests hang forever waiting for the adapter to be ready

Show everything (9 more)
Contract

findMigrationDir function returns a valid directory path that exists and is writable for migration files

If this fails: If migration directory doesn't exist or lacks write permissions, adapter initialization silently continues but migration operations fail later with filesystem errors

packages/db-postgres/src/index.ts:adapter
Environment

drizzle-kit is available as a runtime dependency when migration operations are called

If this fails: Migration commands fail with module not found errors if drizzle-kit is only installed as devDependency or missing entirely

packages/db-postgres/src/index.ts:requireDrizzleKit
Scale

Arrays passed to 'in'/'not_in' operators have reasonable length that won't exceed PostgreSQL's expression limits

If this fails: Very large arrays generate massive OR/AND chains that exceed PostgreSQL's maximum expression depth, causing query compilation errors

packages/drizzle/src/postgres/createJSONQuery/index.ts:createJSONQuery
Domain

sanitizePathSegment function properly escapes all path segment characters that have special meaning in PostgreSQL JSONPath expressions

If this fails: If path segments contain unescaped JSONPath metacharacters like $, @, ?, query syntax breaks or behaves unexpectedly

packages/drizzle/src/postgres/createJSONQuery/index.ts:sanitizePathSegment
Shape

Upload configuration imageSizes array contains objects with exactly 'name', 'height', and 'width' properties of correct types

If this fails: If imageSize objects have wrong property names, missing dimensions, or non-numeric sizes, file upload processing fails or generates broken image variants

test/admin-bar/collections/Media/index.ts:MediaCollection
Contract

afterCreateConnection callback, if provided, completes successfully and doesn't throw exceptions during database initialization

If this fails: If the callback throws errors, MongoDB adapter initialization fails without clear error messages about which custom logic caused the failure

packages/db-mongodb/src/index.ts:Args.afterCreateConnection
Environment

The dist/index.js file exists and exports a main function when the CLI binary executes

If this fails: If TypeScript compilation fails or output directory changes, the CLI command fails with module resolution errors

packages/create-payload-app/bin/cli.js
Resource

PostgreSQL connection pool has sufficient available connections for concurrent database operations

If this fails: When connection pool exhausted, new database requests queue indefinitely or timeout, causing API requests to hang or fail

packages/db-postgres/src/index.ts:connect
Ordering

JSON path operator mapping from Payload query operators to PostgreSQL JSONPath operators is complete and semantically correct

If this fails: If operatorMap lacks entries for operators used in queries, undefined property access generates broken SQL. If mappings are wrong, queries return incorrect results

packages/drizzle/src/postgres/createJSONQuery/index.ts:operatorMap

See the full structural analysis of payload: the pipeline, data models, and system behavior that put these assumptions in context.

Full analysis of payloadcms/payload →

Compare payload

Frequently Asked Questions

What does payload assume that could break in production?

The one most likely to cause trouble: All safe string values match SAFE_STRING_REGEX pattern and any value not matching this regex is dangerous for SQL injection If this fails, If SAFE_STRING_REGEX is too restrictive, legitimate user data gets rejected with 400 errors. If too permissive, SQL injection vulnerabilities slip through the sanitization

How many hidden assumptions does payload have?

CodeSea found 12 assumptions payload relies on but never validates, 5 of them critical, spanning Domain, Shape, Contract, Temporal, Environment, Scale, Resource, Ordering. Most are routine — the analysis flags the two or three most likely to actually bite.

What is a hidden assumption?

Something the code depends on but never checks: a data shape, an ordering, an environment condition, a scale limit, or a contract with another service. It holds until the world it runs in changes, then fails silently.