project
HTML sanitizer used by the extension after an earlier XSS fix, configured with an allowlist that preserved script-like diagram types.
No evidence-backed relationships are recorded.
Googlebot got 0 characters inside a client-rendered blog's root div, its developer found after Google crawled 270 of the posts and indexed none. A bot-only branch in an existing Netlify edge function now hands crawlers the rendered article and JSON-LD.
Reality
OopsSec Store, a deliberately vulnerable Next.js app, lets an admin-uploaded SVG run JavaScript in every visitor's browser. It works because the server trusts the client-set Content-Type and the product page renders SVGs through an <object> tag.
Reality
MDN now lists the Trusted Types API as Baseline 2026, newly available. The JavaScript half only lets you sanitize; require-trusted-types-for is the part that makes an unsanitized assignment throw, and the sanitizer stays yours to write.
Reality
A green CodeQL run and a two-line sanitiser call would have left the boxes and arrows intact on four of five Mermaid diagram types while quietly deleting the text inside them. Counting elements is what caught it.
Reality
ProjectDiscovery says an audit of Markdown Preview Enhanced turned an ordinary repository file into arbitrary file write. Editor extensions run with developer privileges and go uninventoried.
Reality