Role check inside the client bundle
Scan rule · RSC-SEC-019
- Security
- Severity: Medium
- CWE-602
Finds role comparisons such as `role === "admin"` in shipped JavaScript — trivially manipulated in the browser.
Scan tier
- External scan (anonymous)
How to fix it
Evaluate roles server-side; the client may render, never decide.