feat(lint): add eight browser-security ESLint rules

[ryota-murakami]

Summary

Adds eight browser-security ESLint rules to catch runtime XSS sinks and token-storage risks that a type checker cannot see.

Mirrors laststance/eslint-config-ts-prefixer#636. That PR is still open / unreleased, so the rules are added directly to gitbox's eslint.config.mjs for now. The block is commented to be deleted once eslint-config-ts-prefixer ships a release that already includes them — at which point the ...tsPrefixer spread provides them automatically.

Changes

• Add eslint-plugin-browser-security (devDependency, ^2.0.6).
• Enable 8 rules (all error) in eslint.config.mjs, in a dedicated, self-documenting block:
  • no-innerhtml — assigning to innerHTML/outerHTML (top XSS sink)
  • no-eval — eval() and its string-compiling relatives
  • no-jwt-in-storage — JWT in localStorage/sessionStorage (readable by any XSS, unlike an HttpOnly cookie)
  • no-sensitive-localstorage — other secrets in Web Storage
  • no-credentials-in-query-params — creds leak into history / Referer / access logs
  • require-cookie-secure-attrs — Secure + SameSite on JS-set cookies
  • no-postmessage-wildcard-origin — postMessage(..., '*') origin-wildcard leak
  • no-insecure-redirects — open redirect from unvalidated input

Rule names were verified against the installed plugin (2.0.6 ships 46 rules; these are the 8 enabled by #636), rather than trusting the unmerged PR's spelling. No per-file overrides were needed — the repo lints clean as-is.

Testing

• pnpm lint — passes, 0 violations repo-wide (lint-staged pre-commit hook also green)
• pnpm typecheck — passes
• pnpm test — N/A (ESLint-config-only change; no runtime code touched)
• pnpm build — N/A
• pnpm exec playwright test --reporter=list — N/A

Why existing code passes clean:

• no-innerhtml targets .innerHTML = assignments, not React's dangerouslySetInnerHTML prop, so src/app/layout.tsx's theme-flash script is unaffected.
• The sessionStorage value in src/lib/utils/handle-github-token-missing.ts is a numeric retry counter, not a secret, so the storage rules don't flag it.

Screenshots or Recordings

N/A — no UI change.

Checklist

• I read CONTRIBUTING.md
• I updated documentation if needed (config block is self-documenting: inline rationale per rule + link to source PR #636)
• I added or updated tests if needed (N/A — ESLint config change)

---

🌙 Prepared overnight at the maintainer's request. Ready for review.

Summary by CodeRabbit

• New Features

  • Added automated checks for common browser security risks, including unsafe script execution, exposed secrets, insecure cookies, unsafe redirects, and unrestricted messaging origins.

• Chores

  • Added browser security linting support to the project’s development tooling.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
gitbox	Ready	Preview	Sep 1, 2026 12:30pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: ac588817-16fd-4ada-b8b9-07c040e6527c

📥 Commits

Reviewing files that changed from the base of the PR and between 0b7135e and 100b1ae.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !pnpm-lock.yaml

📒 Files selected for processing (2)

• eslint.config.mjs
• package.json

Included review availability: 7 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

---

📝 Walkthrough

Walkthrough

The project adds eslint-plugin-browser-security and enables eight browser security rules for JavaScript and TypeScript files.

Changes

Browser security linting

Layer / File(s)	Summary
Security ESLint configuration package.json, eslint.config.mjs	Adds eslint-plugin-browser-security as a development dependency. Registers the plugin and enforces eight browser security rules as errors.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 100b1

This change adds browser-security lint rules and their development dependency without changing runtime behavior; lint and type checks pass, and no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding eight browser-security ESLint rules.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/browser-security-eslint-rules

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.68%. Comparing base (0b7135e) to head (100b1ae).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #209   +/-   ##
=======================================
  Coverage   70.68%   70.68%           
=======================================
  Files         172      172           
  Lines        4820     4820           
  Branches     1251     1277   +26     
=======================================
  Hits         3407     3407           
  Misses       1394     1394           
  Partials       19       19           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🧪 E2E Coverage Report (Sharded: 12 parallel jobs)

Metric	Coverage
Lines	92.96%
Functions	22.64%
Branches	18.48%
Statements	31.56%

📊 Full report available in workflow artifacts