How do you safely display Markdown produced by a model?
Review note: The answer refers to the original author's CV or target job offer — adapt it to your own experience.
Answer out loud or in your head first, then compare.
Answer
I treat it as untrusted content. A model can repeat a malicious snippet from a document or generate a dangerous link. I use rendering that doesn't run arbitrary HTML and scripts. If I need HTML, I have to sanitise it properly and restrict the allowed elements.
I also check link URLs and embedded content. A citation should point to a source known to the backend, not an arbitrary address invented by the model. React itself helps display plain text safely, but you can bypass that protection by inserting HTML carelessly. I don't run generated code on the same page with full access to the user's session.
Why it matters: Relates to React Markdown in the CV and to practical AI security.
Possible follow-ups: Why doesn't a nice-looking link have to be a real source?
How did it go? Be honest — “Not yet” puts the question on your review list.
Start with
- C-P01 · What is React, and what is a component? — React, Next.js and frontend
- C-P02 · How do props and state differ? — React, Next.js and frontend
- C-P04 · What is useEffect for, and what does the dependency array mean? — React, Next.js and frontend
Further reading
- OWASP: LLM Prompt Injection Prevention Cheat Sheet(opens in a new tab)Docs; accessed 22.10.2026. Threat model, untrusted content, tool control and defence in depth.