Add ESLint configuration and best practices documentation

[rahul-vyas-dev]

Additional Notes:

• add eslint configuration and dependencies for code linting
• Added BestPracticesChecklist.md file and SECURITY.md file

Checklist

• My code follows the project's code style and conventions
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have joined the Discord server and I will share a link to this PR with the project maintainers there
• I have read the Contributing Guidelines

⚠️ AI Notice - Important!

We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact.

Summary by CodeRabbit

• Documentation

  • Added a 49-item best-practices checklist covering project quality, security, reporting, change control, and analysis.
  • Added a security policy with supported versions, vulnerability reporting guidance, and secret-handling recommendations.

• Chores

  • Added commands for linting and coverage reporting.
  • Improved development tooling for code quality checks and TypeScript/React linting.

[coderabbitai]

Walkthrough

The change adds an AOSSIE best-practices checklist, a security policy, and package scripts and development dependencies for linting and coverage.

Changes

Governance and development tooling

Layer / File(s)	Summary
Best practices checklist BestPracticesChecklist.md	Adds a 49-item checklist with scoring rules, evidence requirements, compliance categories, and project-specific guidance.
Security reporting policy SECURITY.md	Documents supported versions, private vulnerability reporting, required report details, and secret-handling guidance.
Lint and coverage tooling package.json	Adds lint and coverage scripts and ESLint-related development dependencies for React and TypeScript projects.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks each practice line,
Keeps secret tokens safe and fine.
Lint hops in, coverage grows,
Clearer paths for code review flows.
“Good governance,” the rabbit knows.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: adding ESLint support and best practices documentation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript-eslint@​8.67.0
	globals@​17.9.0
	eslint-plugin-react-refresh@​0.5.4
	@​eslint/​js@​10.0.1
	eslint-plugin-react-hooks@​7.1.1
	eslint@​10.8.1

View full report

[coderabbitai]

Actionable comments posted: 8

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@BestPracticesChecklist.md`:
- Around line 34-35: Update the Analysis row in the score generator or generated
checklist output so its 7 of 7 result uses the ✅ status, matching the Security
row’s complete-score convention.
- Line 288: Update BestPracticesChecklist.md to end with exactly one trailing
newline, resolving the markdownlint MD047 violation without changing the
document content.
- Around line 243-244: Correct the static_analysis_common_vulnerabilities
checklist entry in BestPracticesChecklist.md to reflect the repository’s actual
configuration: either add and configure a security-analysis dependency alongside
eslint.config.js, or, without such checks, change the item from [x] to [ ].
- Around line 246-247: Change the static_analysis_often checklist item in
BestPracticesChecklist.md from checked to unchecked, leaving its description and
note unchanged.
- Around line 10-13: Resolve the unsupported automation claim in the “How to
use” instructions of BestPracticesChecklist.md: either add the missing
checklist-score workflow that updates the 44/49 summary automatically, or remove
the workflow reference and state that the score must be maintained manually.

In `@package.json`:
- Line 12: Update the package.json lint script to align with the configured
ESLint scope: either add a JavaScript ESLint configuration covering
vite.config.js and src/test/setup.js with their required globals, or change the
command to lint only TypeScript and TSX files. Ensure the selected approach
consistently covers the intended files.

In `@SECURITY.md`:
- Around line 3-8: Update the Supported versions section in SECURITY.md to list
the specific release versions that receive security fixes, define a clear
end-of-support rule, and explicitly mark older tagged releases as unsupported;
retain main as supported if appropriate.
- Around line 21-31: Update the security report guidance near the existing PAT
confidentiality instructions to explicitly tell reporters not to include live
credentials, to redact any token or sensitive value in reports, and to
immediately revoke or rotate credentials that may have been exposed.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: cdd32dd1-5ca8-482c-99f9-ba4c60054c4e

📥 Commits

Reviewing files that changed from the base of the PR and between 2098d23 and efb7958.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• BestPracticesChecklist.md
• SECURITY.md
• package.json

[gitcordapp]

Link your account with Gitcord

Thanks for opening this PR, @rahul-vyas-dev!

To receive Discord notifications and contributor tracking for this organization:

1. Join Discord: https://discord.gg/hjUhu33uAn
2. In Discord, run /link rahul-vyas-dev
3. Paste the verification code into your GitHub bio (or a public gist)
4. Click Verify in Discord (or run /verify-link rahul-vyas-dev)

Once linked, Gitcord can notify you about reviews, merges, and more.

— Posted by Gitcord