Today I read a LinkedIn post by Dan Neciu about XSS still being a real-world problem. That’s one perfect case to show why you either need to:

• check what AI generates for you and know how to review code properly yourself (you’re at least senior-level then)
• have real senior developers in your company who actually know about such problems and detect or directly avoid them
• have automated checks for such things but don’t rely on them (they’re your backup, not your only check)
• have external audits of your code
• hire freelancers who know about such things and can help your junior or senior developers out so they know in future

What devs need to know today

The underlying problem here always was and still is the same. With more tools and the growing complexity of the web platform and its technologies, it becomes harder to discern what’s truly important. It’s crucial today for front-end developers to know how to use and build web apps with:

• React and TypeScript, better also next.js (or Vue with Nuxt, Svelte(Kit))
• Docker, Kubernetes (k8n) and containerised deployment setups
• build workflows (Vite or similar)
• CI and CD workflows

But wait, we’re missing something here

Now, tell me this is not already quite a lot to learn and keep in mind. The problem is that we’re still missing the base here for web apps, which today is also known as »Vanilla Web«:

• HTML (with all its semantics and accessibility as well as performance tricks)
• Network/Performance knowledge of browser engines
• CSS (with all its cascading stuff, different media approaches and graceful degradation techniques)
• native JavaScript and it’s concepts (how it’s failing or (not) handling types)

The job market wants developers to build modern web apps in a short amount of time. If you ask AI to build a web app, you’ll get a next.js web app with wild, copy-pasted spaghetti code. It‘s tempting to just use this, but sooner or later, you run into problems like a vulnerability, or you don’t even understand how to extend the code for a new feature anymore.

Career titles for fun

In the past years, career titles have changed a lot. While ten years ago there were junior and senior levels, now you also have principal or lead developers. Nowadays, there are a lot of senior developers out there. Who still hires a junior or even offers people an apprenticeship? Sadly, way too less companies. Instead, you hire Senior developers in the hope that they can work on their own and build great products.

What I see is that the title »Senior« just means that people already have a couple of years of experience in building for the web. It does not say much about how good they are in terms of architectural thinking, incorporating common standards, acknowledging how a web browser works. It does not mean they know what accessibility or web performance means or how the CSS cascade works. While there are many devs out there with that level knowing about this, I even saw principal engineers missing such fundamentals.

Level up with Vanilla Web fundamentals

If you want to give your career a boost, level up by learning the Vanilla Web.

If you want to ensure your company’s web apps are good, let someone external have a look at it regularly. You’re not only doing yourself as a company a favour because it can avoid security, privacy, accessibility or performance issues before they get public but also your teams and employees who can learn from such audits and improve.