Web and frontend security

Escape or sanitize untrusted content; never inject untrusted HTML or bypass framework sanitization.
Encode output for its exact context (HTML, attributes, JavaScript, CSS, or URL). Prefer text APIs and framework-safe templates; use a maintained sanitizer only when rich HTML is required.
Protect state-changing browser requests from CSRF where applicable; validate origin or anti-CSRF tokens and do not treat CORS as authorization.
Use HttpOnly, Secure, and appropriate SameSite cookie settings for sensitive sessions. Rotate session IDs after authentication and privilege changes.
Validate redirect targets against an allowlist. Avoid sensitive data in URLs, referrers, browser history, analytics, and error reports.
Apply restrictive Content Security Policy and clickjacking protections where applicable. Do not weaken security headers to accommodate unsafe inline content without a reviewed design.
Treat frontend code, source maps, and browser storage as visible. Never place secrets there or rely on client-side checks for authorization.
Protect state-changing operations against clickjacking and unintended form submissions when relevant; require explicit confirmation for high-impact actions.
Keep dependencies and third-party scripts minimal. Apply integrity and origin controls to externally hosted resources where supported.