• Avoid eval(). Instead, opt for alternative options that are more secure.

  • Use HTTPS/SSL to encrypt data exchanged between the client and the server.

  • Set cookies as “secure,” limiting the use of the application’s cookies to only secure web pages.

  • Assign individual tokens for each end user. If the tokens do not match up, deny or revoke access (API access keys).

  • Use safe methods of DOM manipulation. innerHTML does not limit or escape/encode values passed on to them. Use innerText instead. It provides escaping (preventing DOM-based XSS attacks).