Skip to content

I added a security text for issue 78 #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
toreini wants to merge 2 commits into
base: main
Choose a base branch
from
Open

I added a security text for issue 78 #86

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c82351b
I added a security text for issue 78
toreini Sep 30, 2026
f5bc769
Update index.bs
toreini Sep 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -814,4 +814,4 @@ Please see [[WRITING-ASSISTANCE-APIS#security]] for a discussion of security con
The text returned by these APIs is generated by a model and must be treated as untrusted, whether the model runs locally or in the cloud. Because these models emit text, and text can contain HTML-significant characters or well-formed markup, the output can include markup <em>even when the input was plain text</em>; the model does not sanitize its output and is not a security boundary. An attacker who can influence the input (e.g., user-generated content that is being translated) can craft input that induces markup in the output.

Web developers should therefore not insert this output into a document as HTML (for example via {{Element/innerHTML}}, {{Element/insertAdjacentHTML()}}, or `document.write()`), nor otherwise interpret it as code, without first sanitizing it, e.g. using {{Element/setHTML()}} or by assigning it to {{Node/textContent}} where structure is not required. This complements the
input-side guidance against treating web-developer-provided context as instructions in each "the algorithm" section (for example, [[#summarizer-algorithm]]).
input-side guidance against treating web-developer-provided context as instructions in each "the algorithm" section (for example, [[#translator-algorithm]]).
Loading