best-practices

1# Best practices
2 
3Modern web development standards based on Lighthouse best practices audits. Covers security, browser compatibility, and code quality patterns.
4 
5## Evidence-led audit workflow
6 
7When a rendered page is available:
8 
91. Run a live Lighthouse Best Practices audit when that capability is available; with Chrome DevTools MCP, use `lighthouse_audit`. Use navigation mode for a normal page load or snapshot mode when the current state must be preserved.
102. Inspect the listed console and network failures and fetch individual details only when they support a finding.
113. Supplement runtime evidence with dependency, header, configuration, and source inspection; Lighthouse is not a complete security assessment.
124. Fix the implicated code, re-run the same audit, and keep security findings separate from style preferences.
13 
14If live tools are unavailable, use the Lighthouse CLI plus focused dependency and header checks. Never report a high Lighthouse score as proof that the application is secure.
15 
16## Security
17 
18Read [the security reference](references/SECURITY.md) when security is in scope or a live audit surfaces a related failure. It covers HTTPS/HSTS, CSP and Trusted Types, Subresource Integrity, headers, dependencies, sanitization, and cookies.
19 
20At minimum:
21 
22* **Use HTTPS without mixed content.** Add HSTS only after confirming every relevant subdomain supports HTTPS.
23…