Security and Performance
Treat data as untrusted, keep secrets off the client, and optimize measured work.
Client JavaScript runs on a visitor's device and can be inspected or modified. Security decisions belong on a trusted server; the client provides experience, not authority.
Reduce common risks
const message = document.createElement("p");
message.textContent = untrustedComment;
document.querySelector("#comments")?.append(message);
Use textContent instead of injecting untrusted HTML. Validate URLs and API data, protect state-changing requests on the server, use a Content Security Policy, and keep dependencies current.
Keep the main thread responsive
let timer;
input.addEventListener("input", () => {
clearTimeout(timer);
timer = setTimeout(() => runSearch(input.value), 180);
});
Ship less JavaScript, split code by route or feature, batch DOM work, debounce noisy input, and move heavy computation to a worker when needed. Measure with browser performance tools and real-user signals.
Keep this
Validate every boundary, render untrusted text safely, enforce authorization on the server, and optimize the measured bottleneck.