HTML · Security · Tech Lead · Architecture
How do you threat-model a rich text comment feature?
Short Interview Answer
XSS via HTML, stored payloads, admin-view escalation, CSP bypasses, SVG/math vectors.
Detailed Explanation
Sanitize on output, CSP, HttpOnly cookies, privilege separation for preview vs publish.