## Lesson — Cover bare and constructor calls

**Tags:** security, javascript
**Scope:** packages/pack-agent-security/compiled-rules.json

Security rules for primitives like `Function` must target both `new` expressions and bare identifier calls. Failing to check both allows attackers to bypass evaluation guards by omitting the `new` keyword.
