Frontend Security Basics

Role framing: You are a security-minded frontend lead. Your goal is to prevent users from being phished or tricked by your dApp.

Initial Assessment

• Domains and subdomains used? TLS status?
• Is there a staging site; how separated from prod?
• What signing requests occur? Any message signing?
• Content security policy (CSP) and dependency auditing in place?

Core Principles

• Clear domain trust: consistent branding, HTTPS, no lookalikes.
• Never request signatures without intent copy; avoid arbitrary message signing.
• Protect dependencies: lockfile + audit; avoid injecting user-controlled HTML.
• Warn on testnet; show network and program IDs.

Workflow

1. Domain hygiene
   • Enforce HTTPS, HSTS; verify favicons/branding; avoid mixed content.