turborepo
Guides users in configuring and optimizing Turborepo for JavaScript/TypeScript monorepos, enhancing build efficiency and task management.
Install this skill
Security score
The turborepo skill was audited on Jun 15, 2026 and we found 30 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Access to .env file
| 156 | ├─ .env changes not causing rebuilds → .env not in `inputs` |
Access to .env file
| 346 | "globalDependencies": ["**/.env.*local"] |
Access to .env file
| 351 | "globalDependencies": [".env"], |
Access to .env file
| 354 | "inputs": ["$TURBO_DEFAULT$", ".env*"], |
Access to .env file
| 368 | "inputs": [".env"] |
Access to .env file
| 373 | "inputs": ["$TURBO_DEFAULT$", "!$TURBO_ROOT$/.env"] |
Access to .env file
| 389 | "inputs": ["$TURBO_DEFAULT$", ".env*"] |
Access to .env file
| 393 | "inputs": ["$TURBO_DEFAULT$", ".env*"] |
Access to .env file
| 397 | "inputs": ["$TURBO_DEFAULT$", ".env*"], |
Access to .env file
| 407 | "globalDependencies": [".env*"], |
Access to .env file
| 621 | ### `.env` Files Not in Inputs |
Access to .env file
| 623 | Turbo does NOT load `.env` files - your framework does. But Turbo needs to know about changes: |
Access to .env file
| 626 | // WRONG: .env changes don't invalidate cache |
Access to .env file
| 635 | // CORRECT: .env file changes invalidate cache |
Access to .env file
| 640 | "inputs": ["$TURBO_DEFAULT$", ".env", ".env.*"] |
Access to .env file
| 646 | ### Root `.env` File in Monorepo |
Access to .env file
| 648 | A `.env` file at the repo root is an anti-pattern — even for small monorepos or starter templates. It creates implicit coupling between packages and makes it unclear which packages depend on which var |
Access to .env file
| 651 | // WRONG - root .env affects all packages implicitly |
Access to .env file
| 653 | ├── .env # Which packages use this? |
Access to .env file
| 659 | // CORRECT - .env files in packages that need them |
Access to .env file
| 663 | │ │ └── .env # Clear: web needs DATABASE_URL |
Access to .env file
| 665 | │ └── .env # Clear: api needs API_KEY |
Access to .env file
| 669 | **Problems with root `.env`:** |
Access to .env file
| 673 | - Cache invalidation is coarse-grained (root .env change invalidates everything) |
Access to .env file
| 845 | "globalDependencies": [".env"], |
Access to .env file
| 856 | With `futureFlags.globalConfiguration`, the same config moves global settings under `global` — and `.env` becomes a per-task input instead of a global hash input: |
Access to .env file
| 863 | "inputs": [".env"] |
Access to .env file
| 900 | | [environment/gotchas.md](./references/environment/gotchas.md) | .env files, CI issues | |
External URL reference
| 743 | "$schema": "https://v2-9-17-canary-2.turborepo.dev/schema.json", |
External URL reference
| 951 | - Live: https://turborepo.dev/docs |