From 6719f0c7fe68c3f06a66de5d7e6d99fd75fbb181 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C5=ABdolfs=20O=C5=A1i=C5=86=C5=A1?= <rudolfs@osins.org>
Date: Mon, 5 Oct 2026 10:45:10 +0200
Subject: [PATCH] Document hardened {@html} handling

---
 CLAUDE.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index 71ccc44a8..16ae68673 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -119,6 +119,13 @@ crates and files in each.
 - Loading states: `{#await promise}` blocks for inline async;
   local `loading` boolean with `try/catch` for imperative fetches
 
+### `{@html}` and untrusted data (XSS)
+
+- Avoid `{@html}` with backend-derived data (branch/ref names, aliases,
+  descriptions); when unavoidable, its argument must be DOMPurify-sanitized
+  (`sanitizeConfig` in `lib/markdown.ts`) or built from `escape()`'d parts, in
+  the component that renders it.
+
 ### TypeScript / HTTP client
 
 - Derive types from Zod schemas (`z.infer<typeof fooSchema>`), never