Yeah, is like some site creators have learned nothing about the Google blacklist, having user content on your main site is risky. I could include ANY js file into their main page (insanity).

edit: much lack of security - https://buymysideproject.com/startups/iframe-srchttpsbuymysi...

edit 2: YIKES! don't click the authors bio on the main page, the site is already clickjacked. This is a fine example of why you take security seriously.

Output encoding suitable for the destination format, not input sanitisation!

Yep, makes sense. I think Laravel handles sanitisation nicely out of the box, but I made a mistake with the project's description:

<p>{!! nl2br($startup->about)) !!}</p>

Switched now to:

<p>{{ $startup->about }}</p>