In which cases is using v-html (innerHTML) good, and in which cases is it bad? How can you be sure that the content from the server is safe?

Using v-html (similar to innerHTML) is justified when you need to dynamically insert pre-formatted HTML content into the DOM, for example, when displaying content from a CMS that contains tags and formatting.

When it's good:

• The content is fully controlled and trusted (e.g., static HTML prepared by developers).
• You need to display complex markup that is difficult or inconvenient to generate through templates.

When it's bad:

• If the content comes from users or untrusted sources — this opens the door to XSS attacks.
• Frequent updates of content with v-html can lead to performance issues and loss of reactivity.

How to ensure server-side content security:

• The server should perform thorough sanitization of HTML, removing scripts, inline event handlers, and dangerous attributes.
• Use trusted sanitization libraries (e.g., DOMPurify on the client or similar on the server).
• Apply Content Security Policy (CSP) to restrict execution of unwanted scripts.

Thus, security is achieved through trust in the server and its responsibility for content sanitization, along with additional client-side security measures.