What problem does it solve? Frontend security regressions slip into React single-page apps through small diffs: an unsanitized dangerouslySetInnerHTML, a secret accidentally placed in a VITE_* env var, or a route guard removed during a refactor. This Skill encodes the audit rules and checklist needed to catch those issues during code review before they ship. ## Core Features & Use Cases - XSS and injection review: Flags raw HTML rendering, unsafe react-markdown configurations (rehype-raw without sanitization), third-party script tags, and iframes with user-controllable sources. - Token and secret hygiene: Enforces rules for localStorage bearer-token storage (better-auth), forbids secrets in VITE_* env vars, and blocks logging of credentials, tokens, or PII. - Guard and boundary checks: Treats changes to <ProtectedRoute>, <AdminRoute>, useAuth gates, postMessage listeners, and OAuth redirect flows as security-sensitive events requiring origin validation and defense in depth. - Use Case: A PR modifies src/shared/lib/auth-client.ts and adds a markdown renderer for user comments. Run the audit checklist to verify the sanitizer is explicit, the token read/write paths are unchanged, and no new env var leaks a secret. ## Quick Start Review this pull request diff for frontend security issues including XSS sinks, env var leakage, and route guard changes.
