rules-esbuild

esbuild allowOverwrite: true permits the bundler to silently overwrite its own input files — CWE-732. If the entryPoint and outfile resolve to the same path, the source file is destroyed with no warning. Remove this option; set distinct outdir/outfile paths to prevent accidental source destruction.

esbuild banner/footer injects raw JS into every output chunk — CWE-94. If any part of the banner/footer string is derived from external input (environment variables, config files), it could inject arbitrary code into the bundle. Ensure the banner/footer is a static, trusted literal string.

esbuild.buildSync() blocks the Node.js event loop for the entire build duration. In a server or CLI tool that handles concurrent requests this will cause request timeouts. Prefer the async esbuild.build() API which runs the build in a worker thread without blocking.

Sensitive value baked into bundle via esbuild define: — CWE-798. Values passed to define: are inlined as string literals into every output file, making them visible to anyone who can read the bundle (including browsers). Serve secrets from the backend at runtime; never bake them into client-side bundles.

esbuild drop: ['console'] removes all console.* calls at build time. This is valid for production builds but removes all debugging output including error logging. Ensure you have a structured server-side logging strategy before stripping client-side console calls entirely.