Svelte 5 — Gotchas & Quality Patterns

Claude already writes correct Svelte 5. This skill covers the non-obvious traps that waste debugging time and the performance patterns Claude doesn't always reach for.

SSR Global State Leak (Security-Critical)

Module-level $state() in .svelte.ts files is shared across ALL server requests. User A's data leaks to User B.

// DANGEROUS — shared across requests on server
// lib/stores/user.svelte.ts
export let currentUser = $state<User | null>(null); // LEAKS BETWEEN USERS