Lit Template Binding Audit

It reads a Lit or lit-html component file and reports the binding positions where auto-escaping does not apply: unsafeHTML, unsafeSVG, unsafeStatic, a .innerHTML property binding, srcdoc, an on* attribute binding, a URL attribute bound straight from data, and any binding sitting inside a style or script block. Each finding carries a line number and the safe form to write instead.

Developers who ship Lit web components in a product placed on the EU market, and the reviewer who has to sign off on that component. If your team writes lit-html templates and an exploitable injection in one of them would become a CRA Article 14 reporting event, this is aimed at you rather than at a general JavaScript linter user.

ESLint and Prettier read html`...` as a plain tagged template literal, so a binding in a style block or an on* attribute looks like ordinary text to them. A chatbot can explain lit-html escaping but cannot walk your repository line by line and will not tell you which line number in which file ships the hole.

Free is the whole audit of the file you have open: all 15 rules, every finding, every line number, every suggested fix, with no watermark and no run limit. The licence adds a different job: one command sweeps every component in the workspace and writes a dated evidence report listing each unsafe binding with its file and line.

An application-security contractor reviewing component code bills roughly 150 to 250 an hour, and a template review of a component library is rarely under a day. The audit here is 15 rules run against the open file in under a second, and the paid sweep produces the written record that the review would otherwise have to type.