Svelte Security Checklist

Avoid using `{@html}` with unsanitized user input. Svelte auto-escapes text content in templates, but `{@html}` renders raw HTML.

Validate all data received from APIs before rendering. Use TypeScript and Zod for runtime type safety.

Be cautious with actions (use:action) that manipulate the DOM directly -- they bypass Svelte's built-in escaping.

Use `bind:` directives carefully -- two-way bindings can inadvertently expose or modify sensitive data in the component tree.

Implement proper input validation on forms before submission. Client-side validation improves UX but server-side validation is required for security.

Avoid storing secrets in Svelte stores. Writable stores are accessible to any component and can be inspected through dev tools.

Use Content Security Policy headers to mitigate the impact of potential XSS vulnerabilities.

When using Svelte transitions or animations, ensure they do not inadvertently reveal sensitive information through timing or visibility changes.