Validate everything server-side
Client-side validation improves user experience but must never be the only line of defense — all input must be validated again on the server.
Keep dependencies current
Outdated packages are one of the most common sources of exploitable vulnerabilities in web applications. Regular dependency auditing reduces this exposure.
Set security headers by default
Headers such as a content security policy, strict transport security and frame protections reduce the impact of several common attack classes.