best-practices

# Best practices Modern web development standards based on Lighthouse best practices audits. Covers security, browser compatibility, and code quality patterns. ## Evidence-led audit workflow When a rendered page is available: 1. Run a live Lighthouse Best Practices audit when that capability is available; with Chrome DevTools MCP, use `lighthouse_audit`. Use navigation mode for a normal page load or snapshot mode when the current state must be preserved. 2. Inspect the listed console and network failures and fetch individual details only when they support a finding. 3. Supplement runtime evidence with dependency, header, configuration, and source inspection; Lighthouse is not a complete security assessment. 4. Fix the implicated code, re-run the same audit, and keep security findings separate from style preferences. If live tools are unavailable, use the Lighthouse CLI plus focused dependency and header checks. Never report a high Lighthouse score as proof that the application is secure. ## Security Read [the security reference](references/SECURITY.md) when security is in scope or a live audit surfaces a related failure. It covers HTTPS/HSTS, CSP and Trusted Types, Subresource Integrity, headers, dependencies, sanitization, and cookies. At minimum: * **Use HTTPS without mixed content.** Add HSTS only after confirming every relevant subdomain supports HTTPS. * **Treat a strict CSP as defense in depth.** Prefer nonces or hashes and test with report-only before enforcem...