LWC and Aura

These checks cover Lightning Web Components (lwc/<name>/<name>.html and .js) and Aura components (.cmp, Controller.js, Helper.js), matching template directives to the JS sinks they expose.

vulkro-sf scan ./force-app

Checks

Check	What it finds
DOM XSS in LWC (`lwc-dom-manual-bypasses-sandbox`, `LWC-WIRE-XSS-001`)	A `lwc:dom="manual"` element whose JS writes `innerHTML` or calls `insertAdjacentHTML(...)` with unsanitized input.
DOM XSS in Aura (`SF-AURA-CMP-003`)	`<aura:unescapedHtml value="{!v.userInput}" />`, which bypasses Aura's escaping.
Lightning Web Security gaps (`SF-LWS-004` for framing)	An unrestricted `<iframe>` to a non-Salesforce origin, or a Lightning Message Channel with `isExposed=true` and no documented cross-namespace consumer.
CSRF via Aura actions	`@AuraEnabled(cacheable=false)` methods that do DML with no Authorization header or origin check. `cacheable=true` is read-only and not flagged.
postMessage trust (`POSTMSG-001`)	A `message` listener that acts on `event.data` without checking `event.origin` against an allowlist.
Third-party JS	`<script src="...">` from a non-Salesforce CDN. JS must ship as a `StaticResource`.
Insecure endpoint	An LWC `fetch('http://...')` call.
CSS outside the component	A `<link>` loading external CSS, or an inline `<style>` in an Aura `.cmp`.
Hardcoded client secrets	API keys, OAuth tokens, JWT keys or passwords as string literals in controller or helper JS. They ship to every browser.

Confidence is High when the source is @api or a @wire value and the sink is in the same component, Medium when the source is localStorage or sessionStorage, and Low when it is a constant imported from a sibling module.

Example

Non-compliant: a public @api value written to innerHTML inside lwc:dom="manual".

<template>
    <template lwc:dom="manual">
        <div class="preview"></div>
    </template>
</template>

export default class InboxPreview extends LightningElement {
    @api emailBody;
    renderedCallback() {
        this.template.querySelector('.preview').innerHTML = this.emailBody;
    }
}

Compliant: let the template engine escape the value.

<template>
    <template lwc:if={emailBody}>
        <div class="preview">{emailBody}</div>
    </template>
</template>

Checks​

Example​

Checks

Example