You're absolutely right on the alert issue in the wiki: Displaying unsanitized text in this way is a security bug. However, I think the security bug is in the c

You're absolutely right on the alert issue in the wiki: Displaying unsanitized text in this way is a security bug. However, I think the security bug is in the client app, which should sanitize any data it pulls from the server, if the server data may have originated from another user (if this is even possible in the current pageforest API) not in the inherent design of pageforest. But that is indeed a good argument in your favor, ktsmith.