commit ade7ceea3ee2ecfec8fa07b85adb70651d44b35d parent 8f44c86d68d15078f5bd735df874e3b79774656f Author: ASWANTH R <aswanthr82@gmail.com> Date: Mon, 19 Oct 2026 17:27:34 +0530 Update SECURITY.md with XSS protection details Added security update information regarding XSS protection and input sanitization. Diffstat:
| M | SECURITY.md | | | 5 | +++++ |
1 file changed, 5 insertions(+), 0 deletions(-)
diff --git a/SECURITY.md b/SECURITY.md @@ -20,6 +20,11 @@ If you want real bugs and errors, then use our beta verion and say us how is it! >*This version is latest and we made it into production. The version is tested on various angles on production itself. +## Security Updates: + +- Pytml defaults to using `element.text`, which uses the browser's textContent API. This means it is 100% secure against ***Cross-Site Scripting (XSS) attacks***. +If you must use element.html to render raw HTML, never pass untrusted user input directly into it. Use the built-in `pytml.escape()` helper to sanitize the input first. + ## Reporting a Vulnerability First off Thanks!