Framework-agnostic frontend security guide based on OWASP Secure Coding Practices: XSS prevention, CSRF protection, Content Security Policy, secure cookie configuration, client-side auth patterns, input validation, secure storage, and security headers. Applies to any web frontend, not only Nuxt. Activates on XSS, CSRF, CSP, clickjacking, security headers, "Sicherheitslücke", or a frontend security audit. NOT for backend/NestJS security (use generating-nest-servers). NOT for Nuxt-specific implem…
Load nothing from a foreign host at runtime - No CDN scripts, fonts, icons or worker files. A third party that serves an asset on every page load can serve different code tomorrow, sees every visitor, and takes the feature down with it when it is unreachable. Ship assets in the build (import url from "pkg/file?url"). See the developing-lt-frontend skill for the failure this rule comes from.
Complete OWASP reference with code examples: [owasp-reference.md](${CLAUDESKILLDIR}/owasp-reference.md)
Security Checklist
Development
No sensitive data in client-side code
Environment variables separated (public vs private)
