typescript-strict-mode — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited typescript-strict-mode (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The TypeScript compiler configuration is the project's constitutional framework. strict: true activates a suite of sub-options that collectively enforce a "narrow corridor" of logic—making it structurally difficult for developers or AI agents to introduce common classes of runtime bugs.
Every production TypeScript project requires the following minimum configuration:
{
"compilerOptions": {
"strict": true,
"noUncheckedIndexedAccess": true,
"exactOptionalPropertyTypes": true,
"noImplicitOverride": true,
"verbatimModuleSyntax": true,
"noImplicitReturns": true,
"noFallthroughCasesInSwitch": true,
"target": "es2024",
"lib": ["es2024"],
"module": "NodeNext",
"moduleResolution": "NodeNext",
"esModuleInterop": true,
"forceConsistentCasingInFileNames": true,
"isolatedModules": true
}
}strict: truealready enables:noImplicitAny,strictNullChecks,strictFunctionTypes,strictBindCallApply,strictPropertyInitialization,noImplicitThis,useUnknownInCatchVariables, andalwaysStrict. The additional options above extend that baseline.
strictNullChecks — Eliminates the Billion-Dollar MistakeRemoves null and undefined from the domain of all other types. Forces explicit handling of potential absences.
// Without strictNullChecks — silent runtime crash
const user = users.find(u => u.id === id);
console.log(user.name); // Crashes if not found
// With strictNullChecks — compiler forces handling
const user = users.find(u => u.id === id);
if (!user) throw new Error(`User ${id} not found`);
console.log(user.name); // SafenoUncheckedIndexedAccess — NOT in strict, MUST add explicitlyAppends | undefined to any array index or record string-key access. This is the single most impactful flag not in strict.
const items = ['a', 'b', 'c'];
const first = items[0]; // Type: string | undefined
const record: Record<string, number> = { a: 1 };
const val = record['a']; // Type: number | undefined
// Force handling before use:
if (first !== undefined) {
console.log(first.toUpperCase()); // Safe
}exactOptionalPropertyTypes — NOT in strict, MUST add explicitlyDistinguishes between a property being absent and being present with undefined. Prevents subtle bugs in object spreading and API payload construction.
interface Config {
theme?: 'dark' | 'light';
}
// Not allowed with exactOptionalPropertyTypes:
const config: Config = { theme: undefined }; // Error!
// Correct — property simply absent:
const config: Config = {};useUnknownInCatchVariables (in strict since TS 4.4)Changes caught error type from any to unknown. Forces type verification before accessing error properties.
try {
await fetchUser(id);
} catch (err) {
// err is unknown — must narrow
if (err instanceof Error) {
console.error(err.message);
}
}noImplicitOverride — NOT in strict, MUST add explicitlyEnforces the override keyword in class inheritance. Prevents accidental method shadowing after base class refactoring.
verbatimModuleSyntax — NOT in strict, MUST add explicitlyEnsures type-only imports use import type and are erased at compile time. Required for esbuild, swc, and ESM environments.
import type { User } from './types'; // Erased
import { createUser } from './api'; // Kept
import { createUser, type User } from './api'; // Inline form also valid| Flag | In strict? | Catches |
|---|---|---|
strictNullChecks | ✅ | Null/undefined access crashes |
noImplicitAny | ✅ | Silent any leakage |
strictFunctionTypes | ✅ | Unsafe callback assignments |
strictPropertyInitialization | ✅ | Uninitialized class properties |
useUnknownInCatchVariables | ✅ | Unsafe any catch variables |
noUncheckedIndexedAccess | ❌ Add | Unsafe array/record access |
exactOptionalPropertyTypes | ❌ Add | Optional property misuse |
noImplicitOverride | ❌ Add | Accidental method shadowing |
verbatimModuleSyntax | ❌ Add | Type-import erasure bugs |
noImplicitReturns | ❌ Add | Missing return paths |
noFallthroughCasesInSwitch | ❌ Add | Switch fallthrough |
Enable modern ECMAScript with full type safety:
{
"target": "es2024",
"lib": ["es2024"],
"module": "NodeNext",
"moduleResolution": "NodeNext"
}Unlocks native Promise.withResolvers, Object.groupBy, and other ES2024 APIs with compiler-verified types.
For monorepos, use TypeScript project references for incremental builds:
{
"references": [
{ "path": "../packages/shared" },
{ "path": "../packages/api" }
],
"compilerOptions": {
"composite": true,
"declarationMap": true
}
}strictNullChecks + noUncheckedIndexedAccess together form the most powerful combination: every array access becomes T | undefined, and the compiler forces proof of existence at the origin—shifting the burden from consumers to producers.
For complete details, consult:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.