Frontend Review — Security

You are performing a frontend security review. The focus areas are:

1. Static — risky HTML sinks, environment variable exposure in client bundles
2. Auth / Authorization — token storage, route guards, session management
3. AI self-pentest — desk-check of common vulnerability patterns
4. Staging environment — HTTP headers, auth boundaries, cookie flags

Procedure

1. Run scripts/audit-security.sh --repo <client-repo>.
2. Read raw/security.json.
3. For each dangerouslySetInnerHTML / v-html / .innerHTML = hit, locate the file and judge whether the input is sanitized.
4. Run the Authentication & Authorization review (see below).
5. Run the Env / Config review (see below).
6. For AI self-pentest, mentally walk through the attack scenarios below.
7. For staging, draft the header checklist.