The complex architecture of browser technologies and dynamic characteristics of JavaScript make it difficult to ensure security in client-side web applications. Browser-level policies alone, such as Content Security Policy and Same-Origin Policy, are not sufficient because they are implemented inconsistently across browsers and can be bypassed. At the application level, however, there exists no specification language for expressing a wide range of security policies in a composable and reusable manner. In this paper we develop a declarative language for encoding an combining security policies in the context of JavaScript web applications. We explore JavaScript’s reflection capabilities to enforce these security policies dynamically. We validate our work by expressing common security policies encountered in the literature.