FrontendHaltSecurity·Intermediate·Conceptual·1 min read
How does React reduce XSS risk, and where are the escape hatches?
Short interview answer
React escapes text children and attribute values by default, so ordinary interpolation is treated as text. Risk returns with dangerouslySetInnerHTML, unsafe URL handling, direct DOM sinks, third-party widgets, compromised dependencies, or server-rendered markup assembled unsafely.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.