The virtual DOM tree, a key element of the React library, limits the required changes on the actual DOM tree. But that's not all. Proper code management through code-splitting, memoization and server-side rendering adds extra points to performance stats. Regarding security, since React is based on the virtual DOM tree, its API allows early detection of suspicious code before execution. React also provides automatic content escaping, preventing cross-site scripting attacks. At Amsterdam Standard we also use TypeScript in our React projects allowing early detection of potential errors and improving application security.