Web and frontend security

Escape or sanitize untrusted content; never inject untrusted HTML or bypass framework sanitization.
Protect state-changing browser requests from CSRF where applicable.
Use HttpOnly, Secure, and appropriate SameSite cookie settings for sensitive sessions.
Validate redirect targets, avoid sensitive data in URLs, and use CSP and clickjacking protections where applicable.
Treat frontend code and browser storage as visible and never rely on client-side checks for authorization.