security-headers

Generated code must be aligned with security headers (e.g. no unsave JS eval). The permissions policy is especially relevant when changing any code related with the `navigator` object.

Ir a la instalación

Repositorio: trezor/trezor-suite
Última actividad en el origen: 20 de abril de 2026 a las 11:44
Idioma detectado de SKILL.md: inglés
Estrellas: 1032
Forks: 376

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/trezor/trezor-suite --skill security-headers

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

defensive-programming

Type safety practices including exhaustive checks, explicit return types, Result-based error handling, and non-mutating array methods. Use when writing TypeScript logic that handles multiple cases or error conditions, or when sorting, reversing, splicing, or replacing an element (indexed assignment) in an array you did not create.

2026-08-24

performance-complexity

Collection-handling performance for Trezor Suite — indexing before iteration, O(1) sort comparators, and reduce accumulators that don't allocate. Use when writing a loop, sort or reduce over accounts, tokens, transactions or UTXOs.

2026-08-24

performance-dom

Browser rendering performance for Trezor Suite — forced synchronous layout from geometry reads, observer APIs instead of measuring an element, and transitioning only compositor properties. Use when measuring, scrolling or animating a DOM element, or when writing a CSS transition. Web and desktop only.

2026-08-24

Ver todos los de este repositorio

Security headers

Preview

Start local server with production build and applied security headers:

yarn workspace @trezor/suite-web preview

Build & Preview

Build web app and run the preview command:

yarn workspace @trezor/suite-web build:preview

root level command:

yarn suite:build:web:preview

Security Headers

Permissions-Policy Rationale (Enabled Directives)

usb=(self):

packages/connect/src/index-browser.ts (window.navigator.usb.requestDevice(...))
packages/transport/src/transports/webusb.browser.ts

camera=(self):

packages/suite/src/components/suite/modals/ReduxModal/UserContextModal/QrScannerModal/CameraQRReader.tsx (react-zxing camera scanner used for QR input)

clipboard-write=(self):

packages/dom-utils/src/copyToClipboard.ts (navigator.clipboard.writeText(...))
packages/analytics-docs/src/components/AddEventModal/CopyButton.tsx
packages/analytics-docs/src/components/EventCard.tsx

local-network-access=(self):

packages/suite/src/hooks/suite/useLocalNetworkAccessPermission.ts (navigator.permissions.query({ name: 'local-network-access' }))
packages/connect-web/src/impl/core-in-suite-desktop.ts (permission state check for websocket connectivity error handling)

clipboard-read is intentionally not enabled because current direct usage is test-only (suite/e2e/tests/wallet/receive.test.ts) rather than Suite Web runtime behavior.

Disabled directives (=()) are intentionally blocked because there is no direct web runtime use at this time.

Direct Code References

Header values source: packages/suite-web/constants/webSecurityHeaders.ts

Header type constraints: packages/suite-web/types/securityHeaders.ts

MDN references:

name	security-headers
description	Generated code must be aligned with security headers (e.g. no unsave JS eval). The permissions policy is especially relevant when changing any code related with the `navigator` object.