Securing and Shipping Modern JavaScript: BuildScanner and Agent Harness

React Office Hours Starting @ 5pm we hold office hours. Come on by to get some help, ask questions, and meet other developers. Or just hang out! \-\-\- BuildScanner: Source-Mapped Static and Runtime Security Analysis for Modern JavaScript Applications (Laxmi P. Srinivas Sarva) BuildScanner is a developer-first security scanning framework for modern JavaScript applications that combines build-to-source mapping, static taint-aware analysis, and lightweight runtime validation to find high-impact vulnerabilities earlier in the development lifecycle. By using production source maps, BuildScanner maps issues discovered in minified front-end bundles back to original files and lines, improving remediation accuracy. Its static analysis performs AST-based taint tracking tailored for React and Node.js idioms to identify unsafe data flows (including SQL injection, unsafe eval, and dangerouslySetInnerHTML usage). The runtime validation engine executes ephemeral, containerized test runs with headless browser automation to validate CORS, CSP, security headers, and runtime-only behaviors. We discuss implementation choices, limitations (source-map dependence, runtime variability), mitigation strategies, and a roadmap toward broader vulnerability classes and LLM-assisted triage. BuildScanner is available open-source to encourage community-driven improvement and adoption. Bio: Laxmi P. Srinivas Sarva is a Senior Software Engineer based in Austin, TX with 10+ years of full‑stack experience and 8+ years focused on modern JavaScript/TypeScript ecosystems (React, React Native, Node.js). He currently architects scalable frontend and mobile systems at Apex Fintech Solutions. The Other Half of the Stack (Bishop Zareh) Andrej Karpathy published a wiki pattern for giving AI persistent memory. Addy Osmani published production-grade agent skills with verification gates and staged discipline. Both landed in April 2026. Neither combined them into a system you could…