best-practices

Start by running npm audit to find vulnerable dependencies, then enforce HTTPS everywhere, configure Content Security Policy headers, and sanitize user input with DOMPurify instead of using innerHTML directly. Add security headers like X-Frame-Options and Strict-Transport-Security.

A Content Security Policy is an HTTP header or meta tag that controls which resources the browser may load, preventing XSS attacks. Configure it with directives like default-src 'self', script-src with nonces, and frame-ancestors to restrict framing.

Replace document.write with dynamic script element creation, synchronous XHR with async fetch, and Application Cache with Service Workers. Use feature detection with 'in' checks or CSS @supports instead of user-agent sniffing.

Non-passive touchstart and wheel listeners force the browser to wait for potential preventDefault calls before scrolling. Mark them with { passive: true } so scrolling stays smooth, or use AbortController for cleanup.

Do not use it for accessibility audits, SEO optimization, or Core Web Vitals performance work, as those are covered by dedicated skills. It also is not suited for comprehensive multi-area audits spanning all quality dimensions.