angular

Angular Code Review Rules

Security

• Avoid bypassSecurityTrust* methods unless absolutely necessary; when used, require code comments justifying the bypass
• Sanitize dynamic HTML with DomSanitizer only when needed; always prefer Angular's built-in sanitization
• Validate route parameters and query strings to prevent injection attacks
• Use Angular's built-in CSRF protection with HttpClient
• Validate and sanitize data before binding it in templates, especially when displaying user-generated content in *ngFor loops or other directives
• Never interpolate untrusted user input into templates without proper sanitization

Module Organization

• Feature modules should be lazy-loaded where possible
• Use SharedModule for reusable components/pipes/directives. Explicitly define exports to make the module's public API clear
• Use CoreModule for singleton services (provided in root); import only once in AppModule
• Avoid circular module dependencies

Components

• Use OnPush change detection strategy for performance
• Inputs should be immutable (don't mutate input objects)