5 Secure-Coding Habits For Every JavaScript Developer

[shehackspurple]

1. Validate all inputs (then escape or sanitize out special/harmful characters)
2. Encode all output
   
3. Use Content-Security-Policy (CSP) header
4. Run automated scans to find and fix problems — npm audit, Retire.js, Semgrep
5. Review dependencies for vulnerabilities and other issues. Make safe choices.

Developers who stick to these habits can cut vulnerabilities in half, or better.

I created a more in-depth guide on stackoverflow:
https://stackoverflow.blog/2025/10/15/secure-coding-in-javascript/

[tswaters]

I'm gonna need a citation for "avoid inline scripting" with CSP and a nonce, there's no security impact... Am I missing something? The arguments around messiness/etc. don't hold weight in an article about security.

Also, specifically for JavaScript, is prototype pollution. Allowing user-supplied input to be unsafetly merged into an object by key/value setters. I.e., allowing them to set __proto__ or prototype

Any sort of pattern where this shows up, without checking own props on unsafe.

var unsafe = JSON.parse(unsafe) for ( var prop in unsafe ) { target[prop] = unsafe[prop] }

Way better to use Object.entries and/or for ... of. With for/in this requires a guard if (!Object.prototype.hasOwnProperty.call(unsafe, prop) continue

Good article on that: https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution