Lit Template security check — check template bindings in your code

Finds the Lit / lit-html template bindings that auto-escaping does not cover - unsafeHTML, javascript: href, .innerHTML, srcdoc, unsafeStatic - and names the safe form. Runs entirely in your browser — nothing is uploaded.

import { LitElement, html } from 'lit';
import { unsafeHTML } from 'lit/directives/unsafe-html.js';
import { unsafeSVG } from 'lit/directives/unsafe-svg.js';
import { html as staticHtml, unsafeStatic } from 'lit/static-html.js';

export class TicketCard extends LitElement {
  static properties = {
    note: { type: String },
    badge: { type: String },
    docsUrl: { type: String },
    tag: { type: String },
    accent: { type: String },
    preview: { type: String }
  };

render() {
    const tag = unsafeStatic(this.tag);
    return html`
      <style>
        .card { border-left: 4px solid ${this.accent}; }
      </style>
      <article class="card">
        <h2>${this.title}</h2>
        <div class="note">${unsafeHTML(this.note)}</div>
        <div class="badge">${unsafeSVG(this.badge)}</div>
        <a href="${this.docsUrl}">Open the ticket</a>
        <a href="javascript:void(0)">Print</a>
        <button onclick="${this.handler}">Assign</button>
        <div .innerHTML=${this.preview}></div>
        <iframe srcdoc="${this.preview}"></iframe>
        ${staticHtml`<${tag}>${this.note}</${tag}>`}
        <script>
          window.__ticket = "${this.title}";
        </script>
      </article>
    `;
  }

firstUpdated() {
    this.renderRoot.querySelector('.note').innerHTML = this.note;
    this.renderRoot.querySelector('.card').insertAdjacentHTML('beforeend', this.badge);
    document.write('');
  }
}

customElements.define('ticket-card', TicketCard);

as of

Free here: Audit the Lit component file you have open and get every unsafe binding with its line number and the safe form to write instead.. In the editor: Scan every component in the workspace and export one dated evidence report listing each unsafe binding, file and line. — that part asks for a licence key.

Same engine as the VS Code extension, byte for byte.