Security

formsub is careful with how it puts text on the page. That does not replace server-side validation, authorization, or rate limits.

XSS-safe messages

User-visible strings from validation and server responses are written with textContent, not innerHTML.

SweetAlert2 uses text / toast title — never html. Do not render untrusted server payloads as HTML in your own callback either.

Client validation is not a security boundary

Required, email, and math captcha checks run in the browser and can be bypassed. Your endpoint must:

• Re-validate all fields
• Enforce authorization
• Rate-limit and log abuse
• Verify reCAPTCHA tokens server-side

Math captcha

Operands are stored in hidden fields (num1, num2). This is a weak UX deterrent only. Use Google reCAPTCHA v3 if you need meaningful bot resistance.

reCAPTCHA

The client only obtains a token. Verification must happen on the server with your secret key. Never put the secret in front-end code or this repository.

CSRF

formsub does not include CSRF helpers. Append a token in formsub:BeforeSubmit:

window.addEventListener('formsub:BeforeSubmit', (event) => {
  event.detail.append('csrf_token', getCsrfToken());
});

Or include a hidden field in the form. Validate the token on every mutating request.

File uploads

The accept attribute is a hint only. Validate file type, size, and content on the server.

Third-party scripts

Optional globals (Swal, grecaptcha, intlTelInput) are your responsibility. Load them from trusted sources and use CDN integrity attributes when you can.