- Build tool: Vite — always fetch latest docs
- Frontend: Vue — always fetch latest docs
- Styling: Tailwind CSS — always fetch latest docs
- Theming: implement dark/light mode switching
- Responsive: mobile-first layout adapting across all screen sizes
- No comments in template/style blocks for self-explanatory markup
npm security hardening
- Use
npm ciovernpm installfor reproducible builds — respects the lockfile exactly, never mutatespackage-lock.json. - Create an
.npmrcwithignore-scripts=trueto block postinstall attacks during install, andaudit-level=highto surface only high/critical vulnerabilities:audit-level=high ignore-scripts=true - In Docker build stages, use
npm ci --prefer-offline --ignore-scripts. - Add
npm audit signaturesin CI pipelines to verify package tarball signing keys against the npm public key, preventing tampered packages from being injected during install.