Audit my frontend JavaScript for DOM-based XSS and fix every vulnerable sink. Trace data from attacker-controlled sources into dangerous sinks. Sources include location.hash, location.search, URLSearchParams, document.referrer, window.name, postMessage events, and anything rendered from my own API that originally came from user input. Sinks include innerHTML, outerHTML, insertAdjacentHTML, document.write, element.srcdoc, jQuery html(), eval, new Function, setTimeout/setInterval with a string argument, and setting href or src from a user-controlled string (javascript: URLs count). For each flow you find, replace the sink with a safe one: textContent or innerText for plain text, createElement and appendChild for structure, or a sanitizer like DOMPurify when I genuinely need to render user HTML. For URLs, validate the protocol against an allowlist of http: and https: before assigning. For postMessage handlers, verify event.origin against my expected origins before touching the data. Do not remove any feature that displays user content; sanitize it instead. Do not strip formatting my users rely on without telling me which tags you allowed through the sanitizer. List each source-to-sink flow, the fix you applied, and an example payload that would have executed before and is now rendered inert.