Security

Beyond the fundamentals covered in Level 2, production JavaScript applications typically also need:

• Content Security Policy (CSP) — an HTTP header restricting which scripts a browser is allowed to run, limiting the damage of an XSS vulnerability even if one slips through.
• Dependency scanning — npm audit checks installed packages against known vulnerability databases.
• CSRF protection on any server endpoint that changes data based on a logged-in user's session.