The summary.
BUILD SO THE CORE WORKS WITHOUT SCRIPTS
Scripts fail — blocked, slow or erroring — and a page depending entirely on them shows nothing when they do.
USE STRICT COMPARISON, AND CHECK EXPLICITLY FOR ABSENCE WHERE ZERO IS VALID
Loose comparison and truthiness both produce results that surprise everyone once.
USE NATIVE INTERACTIVE ELEMENTS
Buttons, links and inputs already handle keyboard, focus and assistive technology. An element responding only to clicks is unusable by keyboard.
NEVER INSERT EXTERNAL CONTENT AS MARKUP
Set text rather than markup, so it cannot be interpreted as elements.
ALWAYS HANDLE FAILURE IN ASYNCHRONOUS CODE
Network requests fail routinely, and an unhandled failure leaves the interface in an unknown state.
Check the response status before using the content — a failed request still returns a response.
Set a timeout, and prevent repeated submission before the first completes.
EVERYTHING IN THE BROWSER IS VISIBLE TO THE USER
Any key in your JavaScript is public. Route anything requiring a secret through your own server.
CHECK THE SIZE OF WHAT YOU SHIP
Every library is downloaded, parsed and executed by every visitor.
