CI

For years, frontend engineering had a comforting boundary. The backend held the real power: databases, payments, authorization, infrastructure, production secrets. The frontend rendered the interface. It ran in the browser, where users could inspect it, modify it, and ultimately distrust it. That model still contains an important truth. The browser is not a trusted environment. A serious authorization decision cannot depend on what a client-side application chooses to show or hide. ...

Angular apps are rarely “just Angular.” They sit on the CLI, a pile of third-party libraries, often Nx or another monorepo tool, and a lockfile that quietly doubles every quarter. That surface is where a lot of real risk lives: not in your component tree, but in a transitive package nobody reviewed last sprint. Best-practice write-ups keep repeating the same triad — scan regularly, automate checks in CI, and treat framework updates as security work. The missing piece for many teams is turning that advice into a pipeline that generates an SBOM, fails on high-severity CVEs, and tells humans when something broke — without waiting for someone to remember npm audit on Friday. ...

Flaky tests are worse than failing tests. A failing test tells the team something broke. A flaky test teaches the team to negotiate with reality: “Run it again.” “CI is weird today.” “It passes locally.” “That test always fails on Mondays.” “Merge it, the failure is unrelated.” That is how a test suite loses authority. The first few flakes feel harmless. Then people stop reading failures carefully. Then a real regression hides inside the noise. ...