Security Fundamentals

Two vulnerabilities specific to web JavaScript are worth knowing from the start:

• Cross-Site Scripting (XSS) — never insert untrusted text into the page with innerHTML; use textContent instead, or sanitize the input first. element.innerHTML = userInput lets a malicious user run their own script in your page.
• Never trust data from a user or an external API without validating it — check the type and shape of values before using them, especially before sending them to a server.

Security is mostly about consistently applying a small number of habits like these, not one clever trick.