--- paths:

• "**/*.ts"
• "**/*.tsx"
• "**/*.js"
• "**/*.jsx"

---

TypeScript/JavaScript Security

This file extends [common/security.md](../common/security.md) with TypeScript/JavaScript specific content.

Secret Management

// NEVER: Hardcoded secrets
const apiKey = "sk-proj-xxxxx"

// ALWAYS: Environment variables
const apiKey = process.env.OPENAI_API_KEY

if (!apiKey) {
  throw new Error('OPENAI_API_KEY not configured')
}

Agent Support

• Use **security-reviewer** skill for comprehensive security audits