I think Angular is a good example where security-by-default can get annoying. Angular provides ng-bind-html to inject strings of HTML into the dom, but in orde

I think Angular is a good example where security-by-default can get annoying. Angular provides ng-bind-html to inject strings of HTML into the dom, but in order to use it you have to add the ngSanitize module, add $sce to your controller, and run your string through $sce.trustAsHtml(). The first time I did this it probably took me half an hour, even though the HTML was just a string constant. I think a lot of libraries/frameworks choose functionality-by-default over security-by-default to make the onboarding process easier and to promote cool features. If Marked sanitized input by default, how many people would have assumed it simply wasn't capable of handling embedded HTML?