JavaScript Security Best Practices

const data = JSON.parse(localStorage.getItem('userData'));
if (data.isAdmin) {
  showAdminPanel();
}

Data exposure
Client-side authorization bypass
This code demonstrates insecure client-side authorization by relying on locally stored data to make authorization decisions. An attacker could simply modify the localStorage data to set isAdmin=true. Authorization checks should always be performed on the server side, and client-side checks should only be used for UI purposes, never for security decisions.
Memory leak
SQL injection