Fast prototypes often blur the line between demonstration code and production code. Before publishing, review what the browser can see, what the server trusts, and what each user is allowed to do.
Keep secrets outside frontend code
API keys, database credentials, and private tokens belong in server-side environment settings. A value embedded in browser JavaScript is visible to visitors.
Validate on the server
Client-side validation improves the experience but can be bypassed. Validate types, lengths, formats, permissions, and allowed operations again on the backend.
Review dependencies and errors
Use only necessary packages, keep them current, and avoid exposing stack traces or confidential data in public error messages.