This is a great list. I think one of the hardest things to add after the fact are security headers. Once marketing is involved with an app's marketing site, it

This is a great list. I think one of the hardest things to add after the fact are security headers. Once marketing is involved with an app's marketing site, it's going to be hard to add them in later. So I add them from day one, ace the Mozilla Observatory thing, and then if marketing needs something special, we can always deal with it then. Usually the result is something more secure, but sometimes turning off a flag for a single page is fine. If it's the style of app where the backend is basically just a JSON API + workers, I like to follow JSON API[0] but I always add the `meta` and `errors` fields, even if it's just an empty dict, but usually there is something meta, like the latest versions of the client and server or a rate limit use + available combo. It makes writing clients easier. It also has knock-on effects, for example a delete request never gets a 204 NO CONTENT, since there is always content! Once you get a consistent API the frontend just snaps together. Every now and then you may have to deviate a bit for performance or third-party reasons, but it's fine. [0] jsonapi.org