A fast, well-audited library to sanitize HTML and SVG against XSS attacks in browsers and Node.js.
We run DOMPurify at render time or on ingestion to neutralize scripts, event handlers, and dangerous URLs—paired with strict CSP and escaping for defense-in-depth.
How We Use It
- Sanitizing user-generated HTML/markdown output to prevent XSS
- Rendering rich text safely in SPAs/SSR without trusting input
- Enforcing allowlists for attributes, tags, and URL protocols
Auth & Security
Why this matters: Security is trust—modern auth and session practices protect users and keep compliance teams comfortable. Security is foundational. We standardize on modern auth, strong session management, and defense-in-depth controls to protect users and systems. Preferred defaults: BetterAuth for app auth, token-based sessions with rotation, 2FA (TOTP + WebAuthn), Arcjet for edge protection.