SAMPLE EVIDENCE for IN-01 (made-up app Tidyhaus; not a real review)

src/components/Bio.tsx renders the bio as {profile.bio} (React escapes it); no dangerouslySetInnerHTML in the repository.