XSS still starts when untrusted HTML reaches the browser
Encode by context, then enforce Trusted Types. The hatch is still innerHTML, v-html, and dangerouslySetInnerHTML.
Read articleBlog
Practical security engineering for the software we all ship.
Actionable insights on secure coding, reviews, and the defenses that still hold after the framework defaults.
Featured
Latest articles
View all articlesXSS still starts when untrusted HTML reaches the browser
Encode by context, then enforce Trusted Types. The hatch is still innerHTML.
OWASP secure coding checklist
A working order of defenses for people who write the code, not a slide deck.
Input validation that actually holds
Allowlists, types, and where validation has to live so it still holds.
CSRF is a request the browser already intends
Synchronizer tokens, SameSite, and what Fetch metadata can still catch.
Docker security for production
Images, users, and secrets: the controls that still matter in production.
