← Tuesday, October 20, 2026ArchitectureCase study

Close renders untrusted HTML email safely inside its web app

making.close.com 9 min read Editor score 7/10

Close describes building a client-side approach to display synced HTML email in its sales application without exposing users to stored XSS. The design problem is relevant anywhere software renders untrusted content.

What

Close renders synced HTML email in its web app, entirely on the client side, while supporting complex formatting, styles, images and links.

How

The team rejected plaintext-only display and describes the need to prevent email JavaScript from running.

Why it matters

Rendering untrusted HTML safely helps prevent stored XSS attacks that could expose user accounts.

Read on making.close.com → Lobsters

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.