React Security Checklist

Never use `dangerouslySetInnerHTML` with unsanitized user input. If you must render HTML, sanitize it with DOMPurify first.

Avoid storing sensitive tokens in localStorage -- use HttpOnly cookies instead. localStorage is accessible to any JavaScript running on the page.

Validate all user inputs before sending them to your API. Use Zod or Yup for schema validation on the client side.

Be cautious with `href` attributes in links -- `javascript:` URLs can execute code. Validate URLs against an allowlist of schemes (http, https).

Avoid passing unsanitized data to component props that are rendered as HTML attributes. This can lead to attribute injection.

Use React's built-in XSS protection by rendering text content through JSX expressions `{variable}` rather than string concatenation.

Implement proper error boundaries to prevent information leakage through error messages in production.

When using `eval()`, `Function()`, or `new Function()` for dynamic code -- do not. Find an alternative that does not execute arbitrary strings as code.