JS security cheat sheet