diff --git a/aio/package.json b/aio/package.json
index c91c2e933dc4b..1a7afe909141d 100644
--- a/aio/package.json
+++ b/aio/package.json
@@ -19,7 +19,7 @@
     "prebuild-local-ci": "yarn setup-local-ci",
     "build-local-ci": "yarn ~~build --progress=false",
     "extract-cli-command-docs": "node tools/transforms/cli-docs-package/extract-cli-commands.js 2621e1d39",
-    "lint": "yarn check-env && yarn docs-lint && ng lint && yarn example-lint && yarn tools-lint",
+    "lint": "yarn check-env && yarn docs-lint && ng lint && yarn example-lint && yarn tools-lint && yarn security-lint",
     "test": "yarn check-env && ng test",
     "pree2e": "yarn check-env && yarn update-webdriver",
     "e2e": "ng e2e --no-webdriver-update",
@@ -68,6 +68,7 @@
     "create-example": "node ./tools/examples/create-example.js",
     "build-404-page": "node scripts/build-404-page",
     "update-webdriver": "node ../scripts/webdriver-manager-update.js",
+    "security-lint": "tsec -p tsconfig.app.json",
     "~~audit-web-app": "node scripts/audit-web-app",
     "~~check-env": "node scripts/check-environment",
     "~~clean-generated": "node --eval \"require('shelljs').rm('-rf', 'src/generated')\"",
@@ -178,6 +179,7 @@
     "timezone-mock": "^1.1.3",
     "tree-kill": "^1.1.0",
     "ts-node": "^10.0.0",
+    "tsec": "^0.1.5",
     "tslint": "~6.1.3",
     "typescript": "~4.3.4",
     "uglify-js": "^3.13.3",
diff --git a/aio/security-exemptions.json b/aio/security-exemptions.json
new file mode 100644
index 0000000000000..5c16fc3a45c9e
--- /dev/null
+++ b/aio/security-exemptions.json
@@ -0,0 +1,11 @@
+{
+  "ban-reviewed-conversions": [
+    "src/app/custom-elements/code/code.component.ts",
+    "src/app/custom-elements/code/pretty-printer.service.ts",
+    "src/app/documents/document.service.ts",
+    "src/app/shared/security.ts"
+  ],
+  "ban-worker-calls": [
+    "src/app/search/search.service.ts"
+  ]
+}
diff --git a/aio/tsconfig.app.json b/aio/tsconfig.app.json
index 00390f3b7ed69..6cf6e7d7cee6e 100644
--- a/aio/tsconfig.app.json
+++ b/aio/tsconfig.app.json
@@ -4,6 +4,12 @@
     "outDir": "./out-tsc/app",
     "types": [
       "trusted-types"
+    ],
+    "plugins": [
+      {
+        "name": "tsec",
+        "exemptionConfig": "./security-exemptions.json"
+      }
     ]
   },
   "files": [
diff --git a/aio/yarn.lock b/aio/yarn.lock
index 2ab1043967aa4..7a0ab452e3321 100644
--- a/aio/yarn.lock
+++ b/aio/yarn.lock
@@ -12711,6 +12711,14 @@ tsconfig-paths@^3.9.0:
     minimist "^1.2.0"
     strip-bom "^3.0.0"
 
+tsec@^0.1.5:
+  version "0.1.5"
+  resolved "https://registry.yarnpkg.com/tsec/-/tsec-0.1.5.tgz#ef8fc0e06af40de43b3774806ca0b994123cc33c"
+  integrity sha512-mJ8yN/8uyJ4H0cFKshjWrfIeI3mI6Bz/TCX5pvgnuHPZvHjMCDUf2z923gFzqTpXjKMZWZO+zSdD8JoLT/o6OQ==
+  dependencies:
+    glob "^7.1.1"
+    minimatch "^3.0.3"
+
 tslib@2.3.0:
   version "2.3.0"
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.3.0.tgz#803b8cdab3e12ba581a4ca41c8839bbb0dacb09e"