The basics are the well-known part, and they matter: security headers and a Content Security Policy; CORS pointed at real origins rather than a wildcard; DOMPurify for any HTML you render dynamically; URL parameter validation; iframe/clickjacking controls; and cookie, JWT and auth-provider configuration done properly.
Then the secrets rule, which is absolute: anything in the bundle is public. A prefixed environment variable ships to the browser, and even an unprefixed one leaks if the API call fires from the frontend - the fix is a serverless proxy, not a better variable. In the same family: no source maps in production, strip debug logging, and do not advertise your backend URL in the bundle.
What actually catches people is the platform layer around all of that:
Your app may have a second public URL that bypasses your CDN entirely, so every WAF rule and rate limit you configured simply does not apply. Your SPA catch-all answers 200 to every scanner probe, which tells an attacker to keep digging. And your serverless functions silently drop background work after the response is sent - which, when that work is your security logging, means no evidence of the attack you are trying to detect.
Beyond that: rate limiting on serverless routes and a global daily cap, brute-force protection on login, application-level IP blocking, invisible bot verification on sensitive forms, PII hygiene in logs, and escaping any user value you put in an email body. Full item-by-item checklist: https://www.tigzig.com/security/frontend.
← All Agents FAQ