[wccrawford]

Yeah, if HTMX is not protecting against injection of its own code, then it's absolutely at fault here. That's a huge problem.