mark-js-audit

Send JavaScript or TypeScript source code — get back a structured JSON audit: security errors (eval, XSS via innerHTML, __proto__ pollution, hardcoded secrets, debugger statements), warnings (setTimeout with strings, new Function, alert/confirm), and style info (var vs const/let, loose equality, console.log, TODO markers). Metrics: lines, function count, class count, imports. No LLM, no network, deterministic. Input: JS/TS string or JSON {"code": "...", "filename": "optional"}.