Public pages run as the guest user, under tighter rules than anything you test while logged in. Two problems from one project, both invisible until someone checked the result and not the screen.
A public case form let visitors add photos. The files uploaded, and the code then linked each file to the new case by inserting a ContentDocumentLink. For a guest user that insert failed, even from Apex running in system mode.
The fix is to never create the link yourself. Set FirstPublishLocationId on the ContentVersion to the case when you insert the file, and Salesforce creates the link as part of the same operation.
A delete button on a partner page asked “Are you sure?” with the browser’s own confirm dialog. Under Lightning Web Security that call returned nothing, the code read that as a refusal, and the delete never ran. Nobody had reported it because nothing looked broken.
Use the platform’s LightningConfirm module in place of the browser dialog. It returns a promise that resolves to the user’s choice, and it is styled like the rest of the page.
Test public pages in a private browser window as a real guest, and check the record afterwards: is the file on the case, is the row gone. An end-to-end browser test for the public form now does this on every change.