Frontend security baseline

This is a trap-first hardening pass, not a generic security checklist. Start with the default-looking choice that quietly fails open, then replace it with the control that makes the unsafe operation difficult or impossible.

Use this skill when reviewing browser-rendered surfaces before release: rich text, markdown or CMS HTML, script policy, cookie/session behavior, cross-site requests, outbound links, redirects, build/install steps, and client-bundled secrets.

Scope and non-goals

• Covers browser/client-side implementation and frontend-owned build configuration.
• Does not replace backend authz, server-side input validation, threat modeling, or a full application security review.
• For frontend-owned server routes that proxy targets, headers, bodies, or multipart uploads, use bff-proxy-security-contracts.
• For WebView page ↔ native bridge origin/message contracts, use webview-bridge-pages.
• For login/email-code/passkey browser-flow contracts, use frontend-auth-flow-contracts.