&gt; [CVE-2015-7578&#x2F;79] Possible XSS vulnerability in rails-html-sanitizer: You&#x27;re safe if you use a single page application that properly encode for you. Stripping tags isn&#x27;t the best way anyway to filter XSS, so if you&#x27;re encoding, you&#x27;re good.<p>So uh, what if your application is taking an input that&#x27;s then parsed by another application with poor output encoding? Granted, the application that&#x27;s properly encoding for the correct context is good, but any applications which <i>don&#x27;t</i> do that but also use that same dataset are screwed because your application didn&#x27;t perform proper input validation.<p>Defense in depth strategies exist for a reason. Input validation, output encoding for every single context (this includes using angular properly, for instance), anti-xss headers, CSP, the list goes on. These aren&#x27;t all prescribed just to protect that one application. They&#x27;re prescribed so that when applied correctly across all apps, they&#x27;re all protected from negligence in one app harming the data.