Custom HTML for Banners

Hello friends,

Appreciate your thoughts on this, mainly from a security perspective. We were exploring custom HTML Banners in Braze. In this case, the SDK would render both the content payload and the HTML to the website DOM and the browser would execute the code. 

We were conscious that anyone could accidently insert malicious content into the HTML, resulting in PII sharing, stolen cookie tokens etc. Currently we can set allowUserSuppliedJavascript  to 'true' to accept custom JS

Has anyone implemented guardrails within your teams/ processes to manage such risks whilst leveraging the custom HTML for Banners? Would be great to hear your thoughts.

Regards
Raj