How should cross-site scripting XSS be designed for production?

For production, treat user-controlled content as data, rely on safe templating defaults, sanitize only when HTML is intentionally allowed, avoid dangerous DOM APIs, use Content Security Policy, and validate third-party content paths. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.