I built a small Raycast extension - paste invoice JSON, get a formatted HTML/Markdown preview. Zero dependencies in the render logic, 7 unit tests passing, tsc clean. I was pretty confident in it before opening the PR to the official extensions repo.

Within a few minutes, an automated reviewer (Greptile, which Raycast runs on every incoming PR) left 9 comments. Four were tagged P1/security. None of them were things my tests caught, because I'd only tested the happy path and a couple of "normal" edge cases - not actually hostile input.

1. Unescaped field reaching an HTML template

// before export function computeTotals ( data : InvoiceData ) { const subtotal = data . items . reduce (( acc , i ) => acc + i . qty * i . rate , 0 ); const taxRate = data . tax_rate || 0 ; ... }

Enter fullscreen mode

Exit fullscreen mode

tax_rate is typed as number , but nothing enforces that at runtime - it comes from JSON.parse on whatever the user pastes.…