Shield Security System
InertJS takes security seriously. Built into the framework is the Shield engine, which proactively defends against common web vulnerabilities.
DOM Obfuscation
When shipping to production, Shield automatically minifies and encrypts your CSS class names and element IDs. This acts as a deterrent against bots, scrapers, and malicious extensions that rely on fixed DOM selectors.
Auto XSS Sanitization
The Vector template engine treats all interpolated strings as text, not HTML. If you render user input, it is safely escaped by default.
export function render({ data }) {
// Even if data.bio contains <script>, it will be safely escaped!
return vec`
<div>${data.bio}</div>
`;
}
Raw HTML Injection
If you legitimately need to render trusted raw HTML (like markdown output), you can use the raw() utility provided by the Vector engine.
import { vec, raw } from 'inertjs-vector';${raw(data.trustedHtml)}