According to the readme it seems to be escaping by default, kinda: <%= is escaped and <%== is raw output.

So while the raw version is a bit too easy for my tastes (and the first to be listed) the escaped version is still easier/shorter than raw.

Hero does have escaping. Its syntax is <%= variable %>.