I mean ideally you should 1) strip tags 2) encode 3) use X-XSS headers 4) use CSP headers. That way if any one of these fails, the others will catch it.<p>That said, there still shouldn&#x27;t be security holes in the framework.