The 10 Svelte 5 & SvelteKit footguns your AI review bot waves through — and how to catch them in PR review

TL;DR — Svelte 5's runes are powerful and quiet about their failure modes. Generic AI review bots (CodeRabbit, Greptile, the default Copilot reviewer) don't model them, so they approve secret leaks, SSR crashes, and broken reactivity without a word. This post catalogues 10 Svelte 5 / SvelteKit footguns, with safe rewrites, and ships a free GitHub Action (Marketplace) that flags them in the PR.

One import that shipped an API secret to every browser

You needed a feature flag in a component, so you reached for the env:

<script>

import { STRIPE_SECRET_KEY } from '$env/static/private'; // ❌