What is 'dead code elimination' or 'tree shaking' in modern JavaScript bundlers and why does it matter for security?

• A.Tree shaking statically analyzes import/export graphs to remove code that is never called - reducing bundle size. Security relevance: (1) Smaller bundles have less attack surface - unused code paths (including vulnerable library functions) are not shipped to users; (2) Dependency confusion - if a sensitive utility is tree-shaken out, its vulnerable version may be included transitively but never executed; (3) Dead code may still contain credentials or sensitive logic that ships to clients if not eliminated. Effective tree shaking requires ES module syntax (import/export) not CommonJS (require)
• B.Tree shaking is only a performance optimization with no security implications; session data placed in a React or Vue store is encrypted by the framework before it reaches the JavaScript heap; minified JavaScript executes faster because the engine skips parsing identifiers shorter than four characters; browser JavaScript runs in one process per script tag, and a crash in one tag cannot block the page; browsers cap fetch requests at one per origin per second, making batching a correctness requirement rather than an optimization; server-side sessions scale better than JWTs precisely because every app server keeps a full copy of every session in memory