# JustHTML is now safe-by-default
Published: 2025-12-28
Author: Emil Stenström
If you accept HTML from users (comments, profiles, CMS fields), you eventually hit the same problem:
- You want to keep *some* markup.
- You really don’t want to ship an [XSS](https://learn.snyk.io/lesson/xss/?ecosystem=javascript).
That’s why JustHTML now includes a built-in, policy-driven HTML sanitizer, and why serialization is **safe-by-default**.
## Safe-by-default serialization
JustHTML sanitizes when you serialize to HTML or Markdown:
```python
from justhtml import JustHTML
user_html = (
'Hello world '
'bad '
'ok
'
)
doc = JustHTML(user_html, fragment=True)
print(doc.to_html())
print()
print(doc.to_markdown())
```
This drops `