From 76cd56fbc0c05b916c3fd9259ad80e6b66b57916 Mon Sep 17 00:00:00 2001
From: Ofri Peretz <ofri@snappy.com>
Date: Sun, 23 Aug 2026 21:35:30 -0500
Subject: [PATCH] feat(lint): add CWE-tagged security rules to library source
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds eslint-plugin-browser-security and eslint-plugin-secure-coding, scoped to
library source and excluded from **/*.spec.ts — a fixture states the insecure
thing on purpose.

51 rules covering XSS sinks, credential storage and the injection surfaces
around them. Measured against this repository before proposing: 0 findings,
and `eslint .` exits 0 unchanged.

Every message carries a CWE identifier and a CVSS score rather than a rule
name.
---
 eslint.config.mjs | 17 +++++++++++++++++
 package.json      |  2 ++
 2 files changed, 19 insertions(+)

diff --git a/eslint.config.mjs b/eslint.config.mjs
index 1f9c4dc..81d0491 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -5,6 +5,8 @@ import tseslint from 'typescript-eslint';
 import angular from 'angular-eslint';
 import jestDom from 'eslint-plugin-jest-dom';
 import testingLibrary from 'eslint-plugin-testing-library';
+import browserSecurity from 'eslint-plugin-browser-security';
+import secureCoding from 'eslint-plugin-secure-coding';
 
 export default tseslint.config(
   {
@@ -46,6 +48,21 @@ export default tseslint.config(
       '@angular-eslint/no-input-rename': 'off',
     },
   },
+  // Security rules, CWE- and CVSS-tagged. Scoped to library source: the spec
+  // files below are fixtures, and a fixture states the insecure thing on
+  // purpose. Measured against this repository before proposing: 0 findings.
+  {
+    files: ['**/*.ts'],
+    ignores: ['**/*.spec.ts'],
+    plugins: {
+      'browser-security': browserSecurity,
+      'secure-coding': secureCoding,
+    },
+    rules: {
+      ...browserSecurity.configs.recommended.rules,
+      ...secureCoding.configs.recommended.rules,
+    },
+  },
   {
     files: ['**/*.spec.ts'],
     extends: [jestDom.configs['flat/recommended'], testingLibrary.configs['flat/angular']],
diff --git a/package.json b/package.json
index 0a0218a..9e7fe22 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,9 @@
     "autoprefixer": "^10.4.21",
     "cpy-cli": "^6.0.0",
     "eslint": "^9.39.1",
+    "eslint-plugin-browser-security": "^2.0.5",
     "eslint-plugin-jest-dom": "~5.10.1",
+    "eslint-plugin-secure-coding": "^5.1.2",
     "eslint-plugin-testing-library": "~7.16.2",
     "istanbul-lib-instrument": "^6.0.3",
     "jasmine-core": "4.2.0",