chore(lint): add CWE-tagged security rules for src

[ofri-peretz]

What

Adds eslint-plugin-secure-coding and enables its recommended rules on src/**/*.{js,mjs,cjs,ts,tsx}.

No defect is claimed. I measured this repository before proposing anything: 0 findings across the scoped paths. That is the reason to add it rather than a caveat — the block can only go red on something introduced later.

Why this repository

It already runs ESLint with a flat config and lints in CI, and there is no security plugin in the chain today. The rules carry CWE and CVSS metadata, so a finding arrives with a classification rather than a message to interpret.

What I checked before opening this

• Zero findings on src/**/*.{js,mjs,cjs,ts,tsx} with the recommended preset, using the version pinned below.
• Pinned exactly, not as a range, so you are approving the version this was measured against.
• Your 1-day minimum release age (declared in your dependency config) — the pin is 5.1.2, which is older than that window. No exception requested.
• Scoped to source, not the whole repository: tests, fixtures and build output are excluded.
• Lockfile updated with a lockfile-only install; no install scripts were run.

If this is not wanted

Close it and I will not open another. If you would rather have a subset — say, only the injection rules — tell me which and I will send that instead.

🤖 Generated with Claude Code