best-practices

Run npm audit or yarn audit to detect vulnerable packages, then use npm audit fix to auto-patch when possible. The skill also flags risky patterns like prototype pollution via Object.assign or _.merge with unsanitized user input.

Set CSP via an HTTP header rather than a meta tag, restricting default-src to 'self' and using nonces for inline scripts. Include directives like frame-ancestors, base-uri, and form-action to prevent clickjacking and injection attacks.

Avoid document.write, synchronous XHR, and Application Cache, which block rendering or are removed from browsers. Replace them with dynamic script loading, async fetch, and Service Workers respectively.

Yes, it includes React-specific guidance such as Error Boundary components using getDerivedStateFromError and componentDidCatch to capture rendering errors. General patterns like event cleanup and input sanitization also apply to React codebases.

Non-passive touchstart and wheel listeners force the browser to wait for JavaScript before scrolling, causing jank. Adding { passive: true } tells the browser the handler will not call preventDefault, enabling smooth scrolling.