Highlighted by Patrick Ring
From I’m harvesting credit card numbers and passwords from your site. Here’s how. by David Gilbertson
You can still have your big ol’ React app with 138 npm packages for the header/footer/nav/whatever, but the part of the page where the user is typing should be in a sandboxed iFrame and it should run only hand-crafted (and may I suggest, not-minified) JavaScript — if you want to do client-side validation.