Security isn't just a backend concern. Every user input rendered without escaping is a potential XSS vector. Every form without CSRF protection is an invitation. Every client-side route guard without server-side validation is security theater. The OWASP Top 10 is the starting vocabulary for thinking about these risks.

XSS: The Frontend's Original Sin

Cross-site scripting happens when untrusted data is rendered as HTML or JavaScript. React's JSX escapes by default, but dangerouslySetInnerHTML, href="javascript:...", and server-rendered templates without escaping are still common vectors. Always sanitize at the point of output, not input.