# Security

> Security best practices for Angular (XSS, CSP, Route Guards).

- Skill: `majiayu000/security-24` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-24`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-24/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-24

---


# Security

## **Priority: P0 (CRITICAL)**

## Principles

- **XSS Prevention**: Angular sanitizes by default. Do NOT use `innerHTML` unless absolutely necessary.
- **Bypass Security**: Avoid `DomSanitizer.bypassSecurityTrust...` unless the content source is trusted.
- **Route Guards**: Protect all sensitive routes with `CanActivateFn`.

## Guidelines

- **CSP**: Configure Content Security Policy headers on the server.
- **HTTP**: Use Interceptors to attach secure tokens (HttpOnly cookies preferred over LocalStorage tokens).
- **Secrets**: NEVER store secrets (API keys) in Angular code.

## References

- [Security Best Practices](references/security-best-practices.md)

## Related Topics

common/security-standards | components