Imported security libraries are actually used

An import of bcrypt or sanitize-html with zero call sites in the file indicates someone planned to add a security control and stopped. CWE-1164 (Irrelevant Code) covers the surface-level issue, but the real risk is the false assurance it creates during review: a developer or auditor who sees import sanitize-html assumes sanitization is happening somewhere. If the call site never got added, user input goes unsanitized, and the import just misleads everyone looking at the code.

Either add the missing call site or remove the import and package. To audit your security imports quickly:

# Find all security library imports
grep -rn "import bcrypt\|import sanitize\|import xss\|import validator" src/

# Confirm corresponding call sites exist
grep -rn "bcrypt\.hash\|bcrypt\.compare" src/
grep -rn "sanitizeHtml(\|xss(" src/

If the library was meant to hash passwords and no call site exists, add the hash call in src/lib/auth.ts where the password is set. If sanitization was planned for user HTML input, add it in the route that accepts that input. Unused security packages also inflate bundle size and dependency audit surface — remove them if the feature was abandoned.