AngularJS is not impervious to attack, like any other technology. Nonetheless, AngularJS offers built-in defenses against basic security vulnerabilities, including cross-site scripting and attacks with HTML injection. AngularJS makes round-trip escaping for you on all strings and even offers XSRF communication protection on the server-side. AngularJS was designed to be compatible with other security measures such as Content Security Policy (CSP), HTTPS (SSL / TLS) and server-side authentication and authorization, which greatly reduces the potential attack vectors and we highly recommend using them.