Security report generation: wrap blob URL creation in try/finally

[tyevco]

Summary

In plugins/security-audit-panel/src/core/devtools-client.ts (lines 119-133), the generateReport() method creates a blob URL and a temporary DOM element for file download. If any step between creation and cleanup throws, resources leak.

Current Code

generateReport = (): void => {
  const data = this.exportResults('html');
  const filename = \`security-report-\${Date.now()}.html\`;

  const blob = new Blob([data], { type: 'text/html' });
  const url = URL.createObjectURL(blob);
  const link = document.createElement('a');
  link.href = url;
  link.download = filename;
  document.body.appendChild(link);
  link.click();
  document.body.removeChild(link);
  URL.revokeObjectURL(url);
};

Suggested Fix

generateReport = (): void => {
  const data = this.exportResults('html');
  const filename = \`security-report-\${Date.now()}.html\`;

  const blob = new Blob([data], { type: 'text/html' });
  const url = URL.createObjectURL(blob);
  const link = document.createElement('a');
  link.href = url;
  link.download = filename;
  document.body.appendChild(link);
  try {
    link.click();
  } finally {
    document.body.removeChild(link);
    URL.revokeObjectURL(url);
  }
};

Priority

Low — link.click() is extremely unlikely to throw, but the try/finally pattern is defensive best practice for resource cleanup.