Problem
app/page.tsx renders the hero paragraph through raw HTML injection:
<p
className="landing-lead"
dangerouslySetInnerHTML={{ __html: "ModelTrace turns AI usage into <strong>attested facts on-chain</strong>: ..." }}
/>The only thing this achieves is one <strong> tag. The content is a static
string literal, so there is no XSS today — but it establishes the wrong pattern
in the file most likely to be copied when the next contributor adds a section,
and this is a security-focused protocol whose own source will be read
critically.
What to do
Replace it with JSX:
<p className="landing-lead">
ModelTrace turns AI usage into <strong>attested facts on-chain</strong>:
which model ran, under which policy, and what it costs—so procurement,
finance, and auditors share one neutral layer.
}</p>
Then add an ESLint rule (react/no-danger) so the pattern cannot return
without an explicit, reviewed override.
Acceptance criteria
Notes
Good first issue with real value: it is small, verifiable, and it closes the
door behind itself via the lint rule.
Problem
app/page.tsxrenders the hero paragraph through raw HTML injection:The only thing this achieves is one
<strong>tag. The content is a staticstring literal, so there is no XSS today — but it establishes the wrong pattern
in the file most likely to be copied when the next contributor adds a section,
and this is a security-focused protocol whose own source will be read
critically.
What to do
Replace it with JSX:
Then add an ESLint rule (
react/no-danger) so the pattern cannot returnwithout an explicit, reviewed override.
Acceptance criteria
dangerouslySetInnerHTMLremoved fromapp/page.tsxreact/no-dangerenabled in the ESLint configNotes
Good first issue with real value: it is small, verifiable, and it closes the
door behind itself via the lint rule.