Sanitize user HTML safely (DOMPurify + JSDOM)

Letting users paste rich content is a product requirement that can become a security nightmare. I never try to write my own sanitizer. Instead, I run HTML through DOMPurify using JSDOM on the server and keep the allowlist small (minimal tags + attributes). If I need auditability or re-processing later, I store both the raw input and the sanitized output. I also disallow style attributes and inline event handlers, and I strip iframes by default. If embedding is needed, I whitelist specific providers via a separate embed pipeline. The theme is simple: separate ‘what users can submit’ from ‘what we render’, and treat that boundary like a security-critical API.