diff --git a/src/web/static/app.js b/src/web/static/app.js
index e206a73..06a2327 100644
--- a/src/web/static/app.js
+++ b/src/web/static/app.js
@@ -5,6 +5,15 @@
  * and provides REST helper functions used by all pages.
  */
 
+/* ── XSS-safe string helper ───────────────────────────────────────── */
+
+function escapeHtml(text) {
+    if (text == null) return '';
+    const div = document.createElement('div');
+    div.appendChild(document.createTextNode(String(text)));
+    return div.innerHTML;
+}
+
 /* ── REST helpers ───────────────────────────────────────────────── */
 
 async function apiGet(path) {