One thing many people underestimate is how easy it is to run into XSS, XSRF, XSSI when not using a framework, in particular XSS when using native DOM APIs (&quot;location.href = ...&quot; - pwned. &quot;e.innerHTML = ...&quot; - pwned. &quot;a.href = ...&quot; - pwned. &quot;*.src = ...&quot; - pwned.).<p>You might not need a framework, but you&#x27;ll need a structured approach to avoid those problems, and frameworks can help a lot with security.