Client-side code is software logic that runs on the user’s device, such as a phone, browser, or desktop app, instead of on a remote server. It handles tasks like rendering pages, validating input, storing local state, and responding to user actions. In security terms, client-side behavior matters because the device becomes part of the trust boundary: whatever runs there can be inspected, modified, or abused by an attacker with control of the endpoint.
Attackers often target client-side code with malicious scripts, tampered apps, or phishing pages that exploit weak validation and unsafe assumptions. Defenders also rely on client-side logic for security controls such as input filtering, certificate checks, sandboxing, and local permission prompts, but these controls must be backed by server-side verification. In mobile app workflows, a client-side-only build path usually means the app is lightweight and depends less on backend services, which can reduce complexity but does not remove the need to verify origin, signing, and permissions.