Address "Uses eval" Supply Chain Risk

[Josephat-S]

What to build

Socket found 2 instances of eval() usage in 2 packages. Dynamic code execution is a security risk. We need to identify which packages use it and determine if it's avoidable.

Steps to resolve

1. Identify which packages use eval — likely handlebars (it compiles templates to functions).
2. If it's Handlebars: this is expected behavior for a template engine. Document it as an accepted risk.
3. If it's another package: evaluate if we can replace it.

Acceptance criteria

• Identify which packages use eval.
• If Handlebars: document as accepted (template compilation requires it).
• If other packages: replace or pin to versions without eval.
• Add note to SECURITY.md explaining the eval usage.