blog.
Long-form notes on rendering streaming AI agent output safely — security, sanitization, performance, and the patterns that hold up in production.
latest writing.
Streaming Text Motion, on Your Terms
Add optional word and character arrival effects to streaming markdown in Svelte 5, with ready-made presets, an ink reveal, and full control over rendering.
One Code Renderer, Two Highlighters
Why @humanspeak/svelte-markdown now ships an engine-agnostic HighlightedCode renderer with Shiki and TanStack Highlight as interchangeable, opt-in engines — and what streaming code from an LLM taught us about the tradeoff.
Preventing Markdown XSS in Svelte
How markdown becomes an XSS vector in Svelte — javascript: URLs, on* handlers, data: URIs — and how to render user or AI markdown safely by default.
Rendering Markdown in Svelte 5 (The Complete Guide)
A complete guide to rendering markdown in Svelte 5 — built-ins vs parsers vs preprocessors vs component renderers, custom renderers, security, and streaming.
Using marked in Svelte (Safely)
How to use the marked parser in Svelte 5 — the {@html} footgun, why you get an HTML string instead of components, and how to render marked output safely.
Rendering Agent HTML Safely
Render AI-generated HTML safely in Svelte 5 with @humanspeak/svelte-markdown, covering XSS defenses, sanitization hooks, examples, and known gaps.
docs → every defense, every renderer