SEV-2: blocks launch

Raw HTML goes straight onto the page

What goes wrong

A comment or profile field carries a script, and it runs in the browser of every visitor who sees it.

Sanitise the value with DOMPurify before rendering it, or render it as plain text.

npx sigship

Run it in your project. It reports this check as unsanitized-html, along with 16 others. Nothing leaves your machine.