That's really good to hear. I've found LLMs will happily generate XSS vulnerable code, which will make things worse for a while until they can be trained bette

That's really good to hear. I've found LLMs will happily generate XSS vulnerable code, which will make things worse for a while until they can be trained better. In fact, I found it really difficult to get claude-code to use templating libraries and not want to default to hand-written templating with XSS vulnerabilties and injecting content directly, even after going through options with it. There's also a difference between escaping and sanitisation which can be tricky to handle and track, and it can even be dangerous to try to mix different approaches or sanitizers. Having a safe backstop in the form of setHTML() to use will be a fantastic addition to narrow the scope of ways to get it wrong.