What is 'dead code elimination' or 'tree shaking' in modern JavaScript bundlers and why does it matter for security?

• A.Tree shaking statically analyzes import/export graphs to remove code that is never called - reducing bundle size. Security relevance: (1) Smaller bundles have less attack surface - unused code paths (including vulnerable library functions) are not shipped to users; (2) Dependency confusion - if a sensitive utility is tree-shaken out, its vulnerable version may be included transitively but never executed; (3) Dead code may still contain credentials or sensitive logic that ships to clients if not eliminated. Effective tree shaking requires ES module syntax (import/export) not CommonJS (require)
• B.Tree shaking removes CSS that is not referenced in JavaScript files
• C.Tree shaking is a server-side optimization that removes unused database queries
• D.Tree shaking is only a performance optimization with no security implications