1. Anything before the first underscore is classed as the prefix, and all prefixes must be 3 chars or more. Please use a unique prefix for all function names, custom image sizes, classes, constants, hooks, public/global variables, and database entries to avoid conflict issues with plugins and other themes. For example, themename_ OR frameworkname_. You can use frameworkname_ if you’re using a framework, while using themename_ for your themes. Read more at: https://themereview.co/prefix-all-the-things/

2. All theme text strings are to be translatable and properly escaped. https://gist.github.com/kailoon/01fa8e95d2e910e666c6

3. Data must be correctly escaped and sanitized. Look at your $_POST and $GET data.\

4. No inline CSS. All CSS must be separated into an external stylesheet.

5. () & e() does not escape. Simply use WordPress' escaping functions such as esc_attr(), esc_html() etc…

6. All JavaScript should be written with “use strict” mode on; For example, you can do this with jQuery:
(function($){
“use strict”;
//Code here
})(jQuery);

7. Use on(); rather than .click(), .bind(), .hover(), .submit(), etc.