Unapproved posts fire PostCreated with raw, unsanitized unapprovedSource

A sharp edge for anyone writing a webhook consumer (or polling the list/events API).

When a post isn't approved yet, its event payload carries the field unapprovedSource — that's raw CommonMark, i.e. untrusted user input, not the sanitized HTML you'd get from approvedHtmlSanitized. And there's no later PostApproved event to hang a re-fetch on, so a consumer only ever sees the unapproved-source form for these.

Why it matters: a naive consumer that renders "whatever text field is present" as HTML in a dashboard, a chat notification, an email digest, etc. would render attacker-controlled input. That's a stored-XSS foot-gun located in the consumer, not in Talkyard itself — but Talkyard is the thing handing over the raw field, so the responsibility for warning is shared.

To be fair, the TypeScript type does carry a "do not render as html" warning, so it's flagged at the type level. The nudge is just that a warning on the type is easy to miss when you're eyeballing a JSON payload; a note at the payload level (and following through on approved-post events) would catch more people. Since webhook payloads already run as sysbot, this is one more reason to treat webhook output as privileged and sanitize on the way out. From source reading at f220a7d9f.