Lit

Lit does a lot of the right things by default. That’s the good news. The bad news is that teams get comfortable, then punch straight through Lit’s safety model with unsafeHTML, sloppy URL binding, or “just this one” direct DOM write. I’ve seen this happen in otherwise solid codebases. If you build web components with Lit, here’s the reference guide I’d want next to me during code review. The short version Lit escapes text interpolations in templates: ...