LWC security: five places Lightning Web Components go wrong
LWC security is mostly a question of where a component steps outside the framework. A Lightning web component that renders values through its template, reads records through the platform and calls Apex that checks access is hard to break. The trouble starts at the edges: an innerHTML assignment, a lwc:dom="manual" container, an Apex method that trusts its caller, a jQuery copy from 2019 in a static resource, a message listener that never asks who sent the message.
Each of those is a small decision a developer makes on an ordinary afternoon. None of them looks dangerous in a pull request. This post walks through the five that matter most, with vulnerable and fixed code for each, and says plainly what static analysis can and cannot tell you about them.