blog.
Long-form notes on rendering streaming AI agent output safely — security, sanitization, performance, and the patterns that hold up in production.
latest writing.
Preventing Markdown XSS in Svelte
How markdown becomes an XSS vector in Svelte — javascript: URLs, on* handlers, data: URIs — and how to render user or AI markdown safely by default.
Rendering Markdown in Svelte 5 (The Complete Guide)
A complete guide to rendering markdown in Svelte 5 — built-ins vs parsers vs preprocessors vs component renderers, custom renderers, security, and streaming.
Using marked in Svelte (Safely)
How to use the marked parser in Svelte 5 — the {@html} footgun, why you get an HTML string instead of components, and how to render marked output safely.
Rendering Agent HTML Safely
Render AI-generated HTML safely in Svelte 5 with @humanspeak/svelte-markdown, covering XSS defenses, sanitization hooks, examples, and known gaps.
docs → every defense, every renderer