Web Frontend Overlay

Activates when sdlc-config.md sets domain.primary: web-frontend or domain.secondary includes it.

Additional ERROR Rules

• All user inputs must be sanitized before DOM insertion — use framework escaping or DOMPurify
• Images must have alt attributes — decorative images use alt=""
• Interactive elements must be keyboard accessible (focus management, key handlers)
• No localStorage/sessionStorage for sensitive data (tokens, PII)
• CSP (Content Security Policy) headers must be configured — no unsafe-inline for scripts
• All forms must have associated labels and validation feedback

Additional WARNING Rules

• Core Web Vitals targets: LCP < 2.5s, INP < 200ms, CLS < 0.1
• Bundle size budgets enforced: JS < 200KB initial, CSS < 50KB