Wow you have a terrible attitude about security. &quot;None of these are an issue, just program in this [very specific way that requires pre-knowledge of these vulnerabilities] and you&#x27;re safe, anything else is basically negligence.&quot;<p>Your opinions about rails-html-sanitizer are particularly troubling as even if you use the sanitizer as suggested in the docs you&#x27;re vulnerable and your retort is &quot;well you should encode AND sanitise, not just rely on the sanitiser doing what the documentation says it should do!&quot; Why?<p>I have no issue with the wording in the official CVEs. But this attempt at whitewashing the, frankly, pretty serious issues is deplorable.