# Security on post code
**URL:** https://meta.discourse.org/t/security-on-post-code/306894
**Category:** Support
**Tags:** composer
**Created:** [May 6, 2024, 6:55am UTC](https://meta.discourse.org/t/security-on-post-code/306894 "2024-05-06T06:55:58Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Hyan](https://meta.discourse.org/u/Hyan)
#### Post date: [May 6, 2024, 6:55am UTC](https://meta.discourse.org/t/security-on-post-code/306894/1 "2024-05-06T06:55:58Z")
Hi Discourse,
Edit: I used to post my question under [Posting code or preformatted text](https://meta.discourse.org/t/post-code-or-preformatted-text/188910/1).
In my self-hosted discourse, we have a WAF placed in front of installation. It has stricter rules by default which sometimes preventing users posting formatted code from creating. For example, edits contain `/etc/init.d` is taken as security issue. My question is how the preformatted text feature itself ensure any sort of code XSS or attacking. Or discourse core protects the code submitted avoiding security issues? Am I safe to allow all of posts containing code snippet, so that I can adjust the WAF rules?
```plaintext
/etc/init.d/aaa.local Compatibility
```
Thanks!
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 9, 2024, 4:10am UTC](https://meta.discourse.org/t/security-on-post-code/306894/2 "2024-05-09T04:10:00Z")
Discourse protects against XSS in posts using multiple layers of protection.
Including:
- CSP
- Special library that only allows specific tags through
- Cooking markdown (converting from MD → HTML) in a sandbox.
We treat security issues incredibly seriously, you can read more about it at: [HackerOne](https://hackerone.com/discourse)
Your WAF should not need to do any blocking like this.