# Do you set \`unsafe = true\` in \`\[markup.goldmark.renderer\]\`?

**URL:** <https://discourse.gohugo.io/t/do-you-set-unsafe-true-in-markup-goldmark-renderer/37555>\
**Category:** support\
**Created:** [March 8, 2022, 2:35pm UTC](https://discourse.gohugo.io/t/do-you-set-unsafe-true-in-markup-goldmark-renderer/37555 "2022-03-08T14:35:25Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![iaeiou](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/iaeiou/32/15332_2.png) [@iaeiou](https://discourse.gohugo.io/u/iaeiou)\
**Post date:** [March 9, 2022, 7:32am UTC](https://discourse.gohugo.io/t/do-you-set-unsafe-true-in-markup-goldmark-renderer/37555/12 "2022-03-09T07:32:58Z")

</div>

On the same topic:

> [@Hugo + CMS and 'unsafe = true'](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069):
>
> Hi there, we are reviewing Hugo Themes, in particular Netlify-CMS compatible themes. We would like with this CMS to open the publication: to users with no technical skills ( i.e pasting random content in the CMS) to users we don’t trust ( i.e potentially trying to exploit the platform) No moderation will take place, the content goes straight from the CMS to some live & public HTML. Question #1: Do you have general advice about this usecase? (let’s first consider that unsafe is set to fals…

Follow-up:

> [@Hugo with a CMS for Open-publishing: security with Markdown Attributes](https://discourse.gohugo.io/t/hugo-with-a-cms-for-open-publishing-security-with-markdown-attributes/35150):
>
> Hi there, this is a follow-up on [a previous post](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069) about using Hugo with a CMS for open-publishing. To summarize, the original question was: Is it safe to use Hugo and a CMS for open-publishing with the setting unsafe = true? The answer was crystal clear: No Allright, so let’s use unsafe = false But another important issue [was raised by @pamubay](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069/4): Even if you set ‘unsafe = false’, the CMS user can trigger some Javascript: ​```html {onclick="alert('xss')" onmouseenter="alert('xss-onmous…

---

_[View the full topic](https://discourse.gohugo.io/t/do-you-set-unsafe-true-in-markup-goldmark-renderer/37555)._