Does User-Typed Text Render as Text? A Proposed Output-Encoding Posture Axis for AI App Builder Output (September 2026)
A proposed benchmark axis for what a generated app does with a string a person typed when it puts that string back on a page. MDN documents that injected script elements do not execute, so the folk test returns a clean pass on a build that is not safe. Both failure directions are scored: markup that runs, and a surname that renders as punctuation it never contained.
27 min read7