For the client, there's ScanJS [0] which is implemented as a set of eslint rules [1] if you're using eslint. It's a good first pass which will point out the mo

For the client, there's ScanJS [0] which is implemented as a set of eslint rules [1] if you're using eslint. It's a good first pass which will point out the most obvious / common security mistakes in JS in the browser. Though be warned that it will likely raise a fair few false positives. It's probably most useful as an informational dev-time tool. I wouldn't fail builds on it unless you want to be adding eslint-ignore comments everywhere :-) [0] https://github.com/mozilla/scanjs https://github.com/mozilla/scanjs [1] https://github.com/mozfreddyb/eslint-config-scanjs https://github.com/mozfreddyb/eslint-config-scanjs