security-headers

Generated code must be aligned with security headers (e.g. no unsave JS eval). The permissions policy is especially relevant when changing any code related with the `navigator` object.

Ir para a instalação

Repositório: trezor/trezor-suite
Última atividade na origem: 20 de abril de 2026 às 11:44
Idioma detectado do SKILL.md: inglês
Estrelas: 1.032
Forks: 376

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/trezor/trezor-suite --skill security-headers

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

defensive-programming

Type safety practices including exhaustive checks, explicit return types, Result-based error handling, and non-mutating array methods. Use when writing TypeScript logic that handles multiple cases or error conditions, or when sorting, reversing, splicing, or replacing an element (indexed assignment) in an array you did not create.

2026-08-24

performance-complexity

Collection-handling performance for Trezor Suite — indexing before iteration, O(1) sort comparators, and reduce accumulators that don't allocate. Use when writing a loop, sort or reduce over accounts, tokens, transactions or UTXOs.

2026-08-24

performance-dom

Browser rendering performance for Trezor Suite — forced synchronous layout from geometry reads, observer APIs instead of measuring an element, and transitioning only compositor properties. Use when measuring, scrolling or animating a DOM element, or when writing a CSS transition. Web and desktop only.

2026-08-24

Ver todas deste repositório

Security headers

Preview

Start local server with production build and applied security headers:

yarn workspace @trezor/suite-web preview

Build & Preview

Build web app and run the preview command:

yarn workspace @trezor/suite-web build:preview

root level command:

yarn suite:build:web:preview

Security Headers

Permissions-Policy Rationale (Enabled Directives)

usb=(self):

packages/connect/src/index-browser.ts (window.navigator.usb.requestDevice(...))
packages/transport/src/transports/webusb.browser.ts

camera=(self):

packages/suite/src/components/suite/modals/ReduxModal/UserContextModal/QrScannerModal/CameraQRReader.tsx (react-zxing camera scanner used for QR input)

clipboard-write=(self):

packages/dom-utils/src/copyToClipboard.ts (navigator.clipboard.writeText(...))
packages/analytics-docs/src/components/AddEventModal/CopyButton.tsx
packages/analytics-docs/src/components/EventCard.tsx

local-network-access=(self):

packages/suite/src/hooks/suite/useLocalNetworkAccessPermission.ts (navigator.permissions.query({ name: 'local-network-access' }))
packages/connect-web/src/impl/core-in-suite-desktop.ts (permission state check for websocket connectivity error handling)

clipboard-read is intentionally not enabled because current direct usage is test-only (suite/e2e/tests/wallet/receive.test.ts) rather than Suite Web runtime behavior.

Disabled directives (=()) are intentionally blocked because there is no direct web runtime use at this time.

Direct Code References

Header values source: packages/suite-web/constants/webSecurityHeaders.ts

Header type constraints: packages/suite-web/types/securityHeaders.ts

MDN references:

name	security-headers
description	Generated code must be aligned with security headers (e.g. no unsave JS eval). The permissions policy is especially relevant when changing any code related with the `navigator` object.