What applies here

All request filtering — authentication, CSRF protection, and data validation — is implemented as middleware that intercepts requests before route handlers.

usage-convention

Benchmark suites are self-contained in separate directories (benchmarks/routers, benchmarks/jsx, benchmarks/query-param), each with its own package.json that lists popular competitor frameworks or libraries as dependencies for head-to-head performance comparison.

stack-binding

Benchmark suites test Hono against every available alternative for routing and JSX rendering, tracking performance across multiple ecosystems.

stack-binding

Benchmarks are organized into dedicated packages within the repository, each with its own dependency tree and focus (routers, query parsing, JSX rendering).

stack-binding

Every request-processing feature—auth, security, validation, cache, logging—is implemented as middleware and composed through the same onion pipeline, so adding behavior to the framework means adding a middleware module with a (c, next) signature rather than a separate subsystem.

layering

Hono's core is a small dispatcher kernel: middleware composition follows koa-compose, routing is pluggable through Router<T> implementations, and per-runtime differences are bridged by adapters.

layering

Hono's core package is self-contained with zero runtime dependencies: JSX, CSS-in-JS, HTML templating, and middleware composition are implemented in-house, and external libraries like express, react, and zod appear only in benchmark subpackages or devDependencies.

layering

Hono's JSX support is an in-house implementation rather than a React dependency, and the benchmark suite measures it directly against React, Preact, and Nano JSX.

layering

HTTP-boundary data is accessed through TypeScript-inferred types rather than stringly-typed access: hc() derives a typed client from the app's route definitions, and validator() exposes validated request data via c.req.valid() according to the middleware's schema.

layering

Performance benchmarks are maintained as separate sub-packages within the project, each with its own dependency tree and package.json.

stack-binding

Performance-sensitive subsystems are validated by in-repo benchmarks that compare Hono's implementations against third-party alternatives such as find-my-way, koa-router, and trek-router, making performance choices empirically testable rather than asserted.

layering

Request validation is middleware, not handler logic: csrf() checks Origin and Sec-Fetch-Site headers, validator() parses and validates six request targets, and handlers receive pre-validated data through c.req.valid() rather than parsing raw input themselves.

layering

Security is layerable: authentication, CSRF, and header protection ship as opt-in middleware modules and are composed per route rather than enabled by default in the core pipeline.

usage-convention

The core framework uses only Web Standard APIs (Request, Response, Fetch API) and isolates platform-specific code into adapter packages that implement a uniform interface for static assets, WebSockets, and server bindings.

layering

The HTTP surface is wrapped: handlers read inbound data through HonoRequest's parsed accessors and write outbound data through Context helper methods, so raw fetch Request/Response objects are not consumed directly in handler code.

layering

Third-party framework dependencies live only inside benchmarks/*/package.json manifests; the main package's dependency surface is confined to tooling and development types.

stack-binding

TypeScript types are deeply integrated into Hono's API to provide compile-time guarantees for route parameters, request validation results, and client-server contract via the RPC client.

layering

Validation results are stored on HonoRequest and accessed through c.req.valid(); they are not returned as separate artifacts, keeping parsed and validated data attached to the request context.

layering

Concurrency hazard: [ordering-inversion] ./src/jsx/streaming.ts:96 — Inside the Suspense callback, Promise.all(resArray).then(...) modifies buffer[0] via replace(). This callback is invoked by resolveCallback() which runs multiple such callbacks concurrently, sharing the same buffer. | interleaving: 1. Suspense callback A reads buffer[0] = '...<template id="H:0">...</template>...'; 2. Suspense callback B reads same buffer[0]; 3. Callback A replaces template markers with content A; 4. Callback B replaces with content B → A's replacement lost.

Concurrency Hazard · high

Concurrency hazard: [ordering-inversion] ./src/utils/html.ts:168 — Multiple async callbacks sharing a mutable buffer array (buffer[0]) are awaited concurrently via Promise.all. Each callback reads buffer[0] and then writes back (replace, +=). Interleaving between callbacks can cause lost updates. | interleaving: 1. Callback A reads buffer[0] = 'initial'; 2. Callback B reads buffer[0] = 'initial'; 3. Callback A replaces buffer[0] with 'fromA'; 4. Callback B replaces buffer[0] with 'fromB' → 'fromA' is lost.

Concurrency Hazard · high

Correctness footgun: [fail-open-swallow] src/utils/stream.ts:54 — try { await this.writer.write(input) } catch { /* Do nothing */ } in write() — any error from the underlying stream is silently ignored. | damage: Data written after the stream has failed is lost without any notification; the caller may believe the write succeeded, leading to an incomplete response and no error signal to the client.

Correctness Footgun · high

Correctness footgun: [fail-open-swallow] src/utils/stream.ts:73 — try { await this.writer.close() } catch { /* Do nothing */ } in close() — failure to close the stream is swallowed. | damage: Close errors are masked, potentially leaving stream resources (file handles, connections) unreleased, causing resource leaks without any feedback.

Correctness Footgun · high

Correctness footgun: [wrap-asymmetry] src/utils/stream.ts:95 — this.abortSubscribers.forEach((subscriber) => subscriber()) — no try/catch, while write() and close() are protected. A throwing subscriber halts the iteration and skips all later subscribers. | damage: If one onAbort callback throws, the remaining cleanup callbacks are never invoked; the stream may be left with uncanceled readers or unfinished cleanup, corrupting state.

Correctness Footgun · high

Implicit state machine: src/jsx/dom/intrinsic-element/components.ts:129-185 [high] inputs: deDupeByKey · tag · existingElements (8 worlds) | states: smeared — un-named; the implicit states are: direct insertion (no dedupe), link with precedence, existing element matching precedence | fusion: All branches commit DOM mutations: head.insertBefore or head.appendChild; classification (tag, precedence) fused with insertion |…

Hidden state · high

Implicit state machine: src/jsx/dom/render.ts:175-208 [high] inputs: eventSpec · key · value (8 worlds) | states: smeared — un-named; the implicit states are: event handler attribute, dangerouslySetInnerHTML, ref, style, generic attribute (with sub-states for value/checked/selected) | fusion: branch 0 (eventSpec) calls removeEventListener/addEventListener; branch 1 sets innerHTML; branch 2 handles ref cleanup; branch 3…

Hidden state · high

Implicit state machine: src/jsx/dom/render.ts:256-260 [high] inputs: eventSpec · key (4 worlds) | states: smeared — un-named; the implicit states are: event handler removal, ref cleanup, generic attribute removal | fusion: branch 0 calls container.removeEventListener; branch 1 calls refCleanupMap.get()?.(); else calls container.removeAttribute — all branches commit directly | unhandled: No explicit unhandled; else…

Hidden state · high

Implicit state machine: src/jsx/dom/render.ts:444-457 [high] inputs: child.tag · isNew · childNodes[offset] · childNodes[offset - 1] (16 worlds) | states: smeared — un-named; the implicit states are: portal element (skip), new element to append, element needing repositioning (before/appended) | fusion: branch 0 (HONO_PORTAL) decrements offset; branch 1 (isNew) calls container.appendChild; branch 2 calls…

Hidden state · high

Input validation middleware exists but the evidence doesn't show whether all request surfaces are validated — the validator() targets six areas, but we don't know if headers, cookies, or nested objects are covered, and CSRF validation has only one evidence point suggesting narrow application.

Security · low

No PII fields were flagged, which could mean the codebase avoids PII entirely or that the probe did not detect it — a gap in understanding data sensitivity and handling.

Security · low

Strong authentication (JWT, Basic, Bearer, JWK) coexists with ad-hoc per-route authorization, meaning access decisions are scattered and lack a single model to enforce consistency — a route added without explicit middleware could default to permissive.

Security · low

Structural duplication: runtime-tests/deno/favicon.ico · runtime-tests/bun/favicon.ico — ONE concept: favicon icon for test runtimes | drift: No drift detected in the windows shown (identical files) | lockstep: updating the favicon requires editing both deno and bun test assets | composition: move the favicon to a shared test assets directory and reference it via build step or symlink

Structural Duplication · medium

Structural duplication: src/middleware/jwk/jwk.ts · src/middleware/jwt/jwt.ts — ONE concept: JWT-based authentication middleware for Hono with token extraction from header/cookie | drift: JWK variant supports multiple keys, JWKS URI, anonymous access, and additional init parameter; JWT variant uses a single secret and sets jwtPayload on context. Both have identical token extraction and error response logic, but the…

Structural Duplication · high