This project develops a focused, evidence-backed awareness document for the security risks introduced or amplified when JavaScript and TypeScript metaframeworks combine routing, rendering, data access, server capabilities, build tooling, caching, and deployment adapters.
General web, API, and client-side security guidance is essential, but it does not organize the shared trust-boundary failures of frameworks such as Next.js, Nuxt, Astro, SvelteKit, React Router, TanStack Start, Qwik City, Quasar, and SolidStart in one place. Their convenience features can turn a page into an API, a component into a server capability, or an internal transport into a public request variant.
The project identifies those patterns, connects them to established weakness taxonomies and published advisories, and provides prevention and verification guidance that teams can apply throughout design, development, deployment, and operations.
The project will deliver:
- a maintained, prioritized Top 10 awareness taxonomy;
- a detailed risk page for each category, including CWE mappings and representative evidence;
- practical prevention and verification guidance for full-stack metaframework applications;
- a transparent evidence and data-collection method for future revisions;
- versioned documentation releases and an open research reference catalog.
This is an awareness document and a starting point for a risk-based application security program — not a complete security standard or a replacement for framework-specific guidance. Teams should use it with explicit risk assessment, reusable security controls, threat modeling, secure design and code review, continuous testing, and operational metrics.
The first year focuses on establishing the taxonomy and evidence model, validating both with practitioners, and publishing a versioned revision. See the detailed roadmap.
