security rules for htmx are no different than any other hypermedia approach: you need to escape all user content

https://htmx.org/essays/web-security-basics-with-htmx/