Vue Security Checklist

Never use `v-html` with unsanitized user input. Vue's template interpolation `{{ }}` auto-escapes HTML, but `v-html` does not.

Avoid using `eval()` or `new Function()` in Vue components. Use computed properties and watchers for dynamic behavior instead.

Validate all props passed to components that render user-controlled content, especially in server-rendered (SSR) contexts.

Use Vue Router's navigation guards to implement client-side route protection, but always enforce authorization on the server as well.

Be cautious with Vue's `compile()` function, which can execute arbitrary code. Never pass user input to the template compiler.

Store sensitive configuration in environment variables prefixed per your build tool's convention (VITE_ for Vite) and never include secrets in client-side code.

Implement Content Security Policy headers to prevent inline script injection even if an XSS vulnerability exists.

Use Pinia stores carefully -- avoid storing sensitive data in state that persists across page navigations in SSR contexts.