Security

[shama]

[yoshuawuyts]

I'm assuming this has to do with escaping input values? I had some relevant discussions about it in anthonyshort/deku#55 a while ago.

[shama]

Nice thanks for the issue ref.

I think input security should be handled by a server side API. But I think any values going out to the DOM or CSS should escaped automatically by default. But I'm not sure the best way to do that yet.