# OnePanel Security Notes (B3.4)

This build introduces output escaping helpers to reduce XSS risk:

- `e($str)` for HTML text nodes
- `e_attr($str)` for HTML attributes
- `e_url($str)` for URLs

Use these when rendering any untrusted data (DB values, user input, query params, session messages).
