---
paths:
  - "**/*.ts"
  - "**/*.tsx"
  - "**/*.js"
  - "**/*.jsx"
---
# TypeScript/JavaScript Security

> This file extends `common/security.md` with TypeScript/JavaScript-specific content.

## Secret Management

```typescript
// NEVER: Hardcoded secrets
const apiKey = "sk-proj-xxxxx"

// ALWAYS: Environment variables
const apiKey = process.env.API_KEY

if (!apiKey) {
  throw new Error('API_KEY not configured')
}
```

## Optional Review Support

If the current Pi session exposes a security review skill or reviewer tool, use it for a comprehensive audit when the change is security-sensitive. Otherwise perform the review directly; do not assume a named reviewer is installed.