Are there cybersecurity concerns in the frontend? I would have thought you have to assume the client is untrusted and only do security work on the backend

▲

nicce 5 hours ago | parent | next [-]

1. Not storing secrets properly or using hardcoded secrets

2. Wild use of webviews/iframes sometimes easily propagates as XSS in phones

3. Incorrect client-side OAuth 2.0 configuration e.g. with schema-based redirect URLs.

4. Not supporting high-enough API versions, which may prevent some OS-related weaknesses

5. The list is actually very long. Just few top of my mind.

	▲	chis an hour ago \| parent [-]
		Fantastic answer thank you

▲

freeplay 4 hours ago | parent | prev [-]

Nailed it. Assume your client is compromised and/or malicious regardless of how it was built.