react-security-stinger
Review React 18/19 security, including Next.js clients. Covers XSS, secrets and client trust. Delegate Next.js server surfaces to nextjs-security-stinger. Read-only.
- Version
- 1.0.0
- License
- AGPL-3.0-or-later
- Compatibility
- Claude Code 2.1 or newer, Cursor 2.4 or newer, Codex, Cowork. Scripts need Python 3.9 or newer (standard library only). ripgrep recommended, not required.
Pinned to revision 4415691ad3b9, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/react-security-stinger/SKILL.md
- skills/react-security-stinger/guides/00-scoping-and-version-detection.md
- skills/react-security-stinger/guides/01-xss-and-injection-sinks.md
- skills/react-security-stinger/guides/02-rsc-and-server-functions.md
- skills/react-security-stinger/guides/03-secrets-and-data-exposure.md
- skills/react-security-stinger/guides/04-auth-routing-client-trust.md
- skills/react-security-stinger/guides/05-writing-findings.md
- skills/react-security-stinger/guides/06-supply-chain-and-ai-patterns.md
- skills/react-security-stinger/references/REFERENCE.md
- skills/react-security-stinger/references/advisory-table.md
- skills/react-security-stinger/references/checks-auth-routing.md
- skills/react-security-stinger/references/checks-rsc.md
- skills/react-security-stinger/references/checks-secrets-and-data.md
- skills/react-security-stinger/references/checks-supply-chain-and-ai.md
- skills/react-security-stinger/references/checks-xss-and-ssr.md
- skills/react-security-stinger/references/detection-patterns.md
- skills/react-security-stinger/references/finding-rules.md
- skills/react-security-stinger/references/research/distilled-react-security.md
- skills/react-security-stinger/scripts/react_version_check.py
- skills/react-security-stinger/scripts/sink_scan.py
- skills/react-security-stinger/scripts/test/fixtures/clean-rsc/package-lock.json.fixture
- skills/react-security-stinger/scripts/test/fixtures/clean-rsc/package.json.fixture
- skills/react-security-stinger/scripts/test/fixtures/npm-vite-rsc/package-lock.json.fixture
- skills/react-security-stinger/scripts/test/fixtures/npm-vite-rsc/package.json.fixture
- skills/react-security-stinger/scripts/test/fixtures/npm-vite-rsc/src/actions.ts
- skills/react-security-stinger/scripts/test/fixtures/pnpm-router/app/clean.tsx
- skills/react-security-stinger/scripts/test/fixtures/pnpm-router/package.json.fixture
- skills/react-security-stinger/scripts/test/fixtures/pnpm-router/pnpm-lock.yaml.fixture
- skills/react-security-stinger/scripts/test/fixtures/pnpm-router/react-router.config.ts
- skills/react-security-stinger/scripts/test/fixtures/sinks/src/App.jsx
- skills/react-security-stinger/scripts/test/fixtures/sinks/src/actions.js
- skills/react-security-stinger/scripts/test/fixtures/sinks/src/auth.js
- skills/react-security-stinger/scripts/test/fixtures/sinks/src/server.js
- skills/react-security-stinger/scripts/test/fixtures/yarn-berry-waku/package.json.fixture
- skills/react-security-stinger/scripts/test/fixtures/yarn-berry-waku/yarn.lock.fixture
- skills/react-security-stinger/scripts/test/fixtures/yarn-classic-cra/package.json.fixture
- skills/react-security-stinger/scripts/test/fixtures/yarn-classic-cra/yarn.lock.fixture
- skills/react-security-stinger/scripts/test/run_tests.py
Every link opens the file at its source, pinned to the revision this page describes.