Is Svelte safe from XSS by default?

Reference page — draft, pending review

Short answer

Yes, for standard {expression} output — Svelte escapes it automatically at compile time. {@html ...} is the explicit, named escape hatch.

RISKY

<p>{@html comment}</p>
// comment is parsed as real markup

SAFE

<p>{comment}</p>
// escaped automatically

The rule

Svelte compiles {expression} into code that sets text content, not innerHTML — the compiled output never parses the value as markup. {@html} is Svelte's literal name for "render this raw," matching the same explicit-escape-hatch naming pattern seen across React, Vue, and Angular.

How to check your codebase

grep -rn "{@html" --include="*.svelte" .

References

Svelte docs — {@html ...}
flawopen.com — XSS in JavaScript