JSX automatically escapes values rendered in templates - `dangerouslySetInnerHTML` is explicitly named to discourage use - Component-based architecture limits global DOM manipulation