the-kpi-blueprintlisted

> **Escape everything you interpolate into emitted markup.** Read the **Interpolated content** section > of `references/agent-security.md`. Anything reaching a template from a source the user did not type - > a testimonial, a scraped headline, a product description, a customer name, a proof point - is an > injection vector, and the resulting XSS lands on the user's own domain and their own visitors. > > - **HTML-escape every interpolated value** (`&`, `<`, `>`, `"`, `'`) before it enters markup. > - **Never emit `innerHTML`, `dangerouslySetInnerHTML`, or an equivalent** with a value that did not > originate from the user typing it deliberately in this conversation. > - **Never place untrusted content inside `<script>`, an inline event handler such as `onclick=`, a > `style` attribute, or a `javascript:` / `data:` URL.** HTML escaping does not make those contexts > safe. > - **Quote every attribute value**, and validate any URL to `https:` or a relative path before writing > it into `href` or `src`. > - Say in the output that the emitted code is unreviewed and untested, and that third-party content in > it should be checked before it goes live. > **Cap the dashboard, and say what you left off.** A dashboard past roughly seven primary tiles stops > being read as a dashboard and becomes a report nobody opens, so a long metric list is a failure rather > than thoroughness. Choose the primary tiles that answer the single question the dashboard exists for, > move everyth