Skip to main contentLearn
Use Learn to understand and apply the system. Use Standards when you need the governing contract.
1Escape textTreat text as text so markup is not executed accidentally.
→
2Strip unsafe tags and handlersRemove markup behaviors that do not belong in trusted rendered output.
→
3Allow only needed URI schemesKeep the protocol surface narrow by default.
→
4Enable external assets deliberatelyOnly relax the boundary when the workflow explicitly requires it.
→
5Surface warningsTell the operator what changed so security behavior remains visible.
The safest behavior should also be the easiest behavior to keep.
The safest Cuddler pattern is the simplest one: treat untrusted content as untrusted all the way through rendering.
Pattern
- Escape text content.
- Strip unsafe tags and event handlers.
- Allow only the URI schemes the use case genuinely needs.
- Permit external assets only when the workflow explicitly requires them.
- Surface warnings so the user understands what changed.
Why It Matters
- It protects the rendering surface from accidental script execution and unsafe links.
- It makes the trust boundary obvious to authors and reviewers.
- It keeps the default behavior useful without silently widening risk.
Use This When
- documents are authored from mixed-trust sources
- the output is shared beyond the immediate authoring team
- you want a conservative baseline that does not require extra explanation
