[jstanley]

This sounds potentially useful, but I'm not sure about the practicality.

It's usually pretty easy to not write XSS vulnerabilities, as long as you know they are a thing you need to think about.

Given that people don't bother to avoid writing XSS bugs right now, why do you think they will bother to use your tool to avoid writing XSS bugs in the future?

[bugmen0t]

Given the new DOM API, it’s also relatively easy to forbid the "bad APIs" using something like eslint (at the source level) or Trusted Types (at runtime).

The hope is to also cater to frontend frameworks enough that they will adopt it. There are already some conversations.