Answered that above: https://news.ycombinator.com/item?id=38692597
We've also updated the doc with some manual sanitization[1], but that's definitely not the final form of this POC.
[1]: https://postgrest.org/en/stable/how-tos/providing-html-conte...