Compiled files sitting next to sources fake your build verificationgotchas / toolingStale .js/.d.ts in src/ greps like live code while main points at lib/; ask require.resolve, date-check with git log, and keep the ignore rule narrow enough to spare hand-written .d.ts
npm audit --omit=dev overstates what SPFx actually shipsgotchas / spfxSPFx keeps its Node build toolchain in dependencies, so 229 „production“ findings can hide a single real one; grep the published bundle and always include a control sample