From 4f1a00f4ba22e7f386bbfb4ba44aeee2124fa3ca Mon Sep 17 00:00:00 2001
From: Ofri Peretz <ofriperetzdev@gmail.com>
Date: Tue, 25 Aug 2026 00:35:12 -0500
Subject: [PATCH] chore(lint): add CWE-tagged security rules for src

Scoped to src/**/*.{js,mjs,cjs,ts,tsx}. Measured against this repository first: 0 findings, so the block goes red on a new one rather than on what is here today.

Pinned exactly rather than as a range, and to a release older than the 1-day minimum this repository declares.
---
 eslint.config.mjs | 12 ++++++++++++
 package.json      |  1 +
 2 files changed, 13 insertions(+)

diff --git a/eslint.config.mjs b/eslint.config.mjs
index 51381f7..ddcff3d 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -3,6 +3,7 @@ import { defineConfig, globalIgnores } from 'eslint/config';
 import importPlugin from 'eslint-plugin-import';
 import unusedImports from 'eslint-plugin-unused-imports';
 import tseslint from 'typescript-eslint';
+import secureCoding from 'eslint-plugin-secure-coding';
 
 export default defineConfig([
   js.configs.recommended,
@@ -38,4 +39,15 @@ export default defineConfig([
     },
   },
   globalIgnores(['dist/**', 'node_modules/**']),
+
+  // Security rules, CWE- and CVSS-tagged, scoped to source.
+  //
+  // Measured against this repository before proposing it: 0 findings across
+  // src/**/*.{js,mjs,cjs,ts,tsx}. That is the point rather than a caveat — the block goes red on a
+  // new one, not on what is here today.
+  {
+    files: ['src/**/*.{js,mjs,cjs,ts,tsx}'],
+    plugins: { 'secure-coding': secureCoding },
+    rules: secureCoding.configs.recommended.rules,
+  },
 ]);
diff --git a/package.json b/package.json
index fdc624f..9cc6db5 100644
--- a/package.json
+++ b/package.json
@@ -59,6 +59,7 @@
     "dotenv": "^17.4.2",
     "eslint": "^9.39.5",
     "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-secure-coding": "5.1.2",
     "eslint-plugin-unused-imports": "^4.4.1",
     "knip": "^6.32.1",
     "lefthook": "^2.1.10",