Use textContent over innerHTML so you can bind untrusted text values

[codymikol]

Using innerHTML allows for XSS attacks, textContent does not allow this.

[bersLucas]

Can you run yarn run default and commit the results so the docs are updated too?

[codymikol]

Sure, but going forward I'd recommend checking out the the docs for npm scripts, essentially you can hook all of the building and cleaning up of your dist so it doesn't have to be maintained in the repo.

https://docs.npmjs.com/misc/scripts

tl;dr; running npm publish will create all of that stuff, publish it, and clean it out so you don't have to bother committing all of it every time.

🐔