Ask HN: What are some great resources to build a secure website?

For the client, there's ScanJS [0] which is implemented as a set of eslint rules [1] if you're using eslint.

It's a good first pass which will point out the most obvious / common security mistakes in JS in the browser. Though be warned that it will likely raise a fair few false positives. It's probably most useful as an informational dev-time tool. I wouldn't fail builds on it unless you want to be adding eslint-ignore comments everywhere :-)

[0] https://github.com/mozilla/scanjs

[1] https://github.com/mozfreddyb/eslint-config-scanjs

https://cheatsheetseries.owasp.org

Pen and paper