StaticGuard
A pre-publish security linter specifically for client-side web apps — single index.html files, static SPAs, offline tools — that catches the exact holes the Dev.to audit surfaced.
Indie developers and small teams shipping static, offline, or no-backend web apps
- AST scan for prototype-pollution patterns like Object.assign(target, JSON.parse(...)) and unsafe merge helpers
- File-import auditor that flags any user-controlled string flowing into img.src, fetch, a.href, CSS url() or iframe.src
- Schema allowlist generator that produces a runtime sanitizer mapping your JSON shape to safe types and value ranges
- One-click CSP meta tag generator tuned to the file features you actually use (data: images, no network, etc.)
A seasoned developer publicly found three real security holes in an app with no server, no DB and no network — proving that the 'static = safe' assumption is widespread and wrong right as more indie tools ship this way.
Google Cloud and Workos both published SPA-vulnerability articles confirming real client-side security concerns, but the niche of indie devs shipping static/offline SPAs is narrow; the source Dev.to post only got 7 reactions.Your Single-Page Applications Are Vulnerable: Here's How to Fix Them ↗Security threats in SPAs and how to defend against them ↗
Analysis-tools.dev lists 73+ security linters and SAST tools, and Semgrep/Snyk/CodeQL cover client-side JS generically, but none target single-file static SPAs or offline-first apps specifically — a real but narrow gap that incumbents could fill.73 Security Static Analysis Tools, Linters, And Code Formatters ↗Pricing and Plans | AppSec Platform SAST, SCA, and Secrets | Semgrep ↗
Snyk and Semgrep monetize via per-seat enterprise pricing ($25+/dev/mo) aimed at teams, but indie devs shipping static SPAs are notoriously price-sensitive and the addressable spend per developer is low; OSS linters (Semgrep OSS, Bearer) compete on the free tier.Snyk plans and pricing ↗Semgrep Pricing in 2026: Open Source vs Team vs Enterprise Costs ↗
Static, offline-first and browser-only apps (Tauri, single-file HTML tools, PWA offline apps) are a growing category, and client-side security threats (XSS, exposed tokens, localStorage abuse) are evergreen concerns.
Building a JS/HTML AST-based security linter is straightforward using existing parsers and ESLint plugin patterns; the scriptease repo demonstrates client-side taint analysis is implementable, though tuning rules to low false-positives for indie codebases takes effort.GitHub - alexcolb/scriptease: A vulnerable JavaScript SPA (no back end) ↗