🛡️ TSscrutinizer — Combined Security Report

```diff
- this.rendered = this.sanitizer.bypassSecurityTrustHtml(userComment);
+ this.rendered = userComment;
```

```diff
- el.innerHTML = html;
+ el.textContent = html;
```

```diff
18:   @Input() raw = "";
19:   rendered: SafeHtml = "";
20: 
21:   constructor(private sanitizer: DomSanitizer, private route: ActivatedRoute) {
22:     // VULN (CWE-79): user-controlled query param flows into trusted HTML.
23:     const userComment = this.route.snapshot.queryParamMap.get("comment") ?? "";
-24:     this.rendered = this.sanitizer.bypassSecurityTrustHtml(userComment);
+24:     this.rendered = this.sanitizer.sanitize(SecurityContext.HTML, userComment);
25:   }
26: 
27:   preview(html: string): void {
28:     const el = document.getElementById("preview");
29:     if (el) {
-30:       // VULN (CWE-79): direct innerHTML assignment of untrusted content.
-31:       el.innerHTML = html;
+30:       // Use textContent to prevent XSS
+31:       el.textContent = html;
32:     }
33:   }
```

```diff
1: // Application environment configuration.
2: export const environment = {
3:   production: false,
4:   apiUrl: "http://api.acme-portal.example.com/v1",
5:   // VULN (CWE-798): hardcoded third-party credential committed to source.
6:   // stripeSecretKey: "sk_live_51JZ9aB2eZvKYlo8cQx7Hn4kPq2rT6uW",
7:   analyticsToken: "tok_a1b2c3d4e5f6g7h8i9j0klmnop"
8: };
9: 
```

```diff
- private jwtSecret = "super-secret-signing-key-do-not-share-12345";
+ private jwtSecret: string;

constructor(private http: HttpClient) {
  this.fetchJwtSecret();
}

private fetchJwtSecret(): void {
  this.http.get<{ secret: string }>('/api/config').subscribe(response => {
    this.jwtSecret = response.secret;
  });
}
```