diff --git a/eslint.config.mjs b/eslint.config.mjs
index 51381f7..ddcff3d 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -3,6 +3,7 @@ import { defineConfig, globalIgnores } from 'eslint/config';
 import importPlugin from 'eslint-plugin-import';
 import unusedImports from 'eslint-plugin-unused-imports';
 import tseslint from 'typescript-eslint';
+import secureCoding from 'eslint-plugin-secure-coding';
 
 export default defineConfig([
   js.configs.recommended,
@@ -38,4 +39,15 @@ export default defineConfig([
     },
   },
   globalIgnores(['dist/**', 'node_modules/**']),
+
+  // Security rules, CWE- and CVSS-tagged, scoped to source.
+  //
+  // Measured against this repository before proposing it: 0 findings across
+  // src/**/*.{js,mjs,cjs,ts,tsx}. That is the point rather than a caveat — the block goes red on a
+  // new one, not on what is here today.
+  {
+    files: ['src/**/*.{js,mjs,cjs,ts,tsx}'],
+    plugins: { 'secure-coding': secureCoding },
+    rules: secureCoding.configs.recommended.rules,
+  },
 ]);
diff --git a/package.json b/package.json
index fdc624f..9cc6db5 100644
--- a/package.json
+++ b/package.json
@@ -59,6 +59,7 @@
     "dotenv": "^17.4.2",
     "eslint": "^9.39.5",
     "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-secure-coding": "5.1.2",
     "eslint-plugin-unused-imports": "^4.4.1",
     "knip": "^6.32.1",
     "lefthook": "^2.1.10",