anchor.diff:      includes a matching `XSRF-TOKEN` cookie and `X-XSRF-TOKEN` header.
   
       XSRF/CSRF tokens should be unique per user and session, have a large random value generated by a
  -    cryptographically secure random number generator, and should expire in a day or two.
  +    cryptographically secure random number generator, and expire in a day or two.
   
       Your server may use a different cookie or header name for this purpose.
       An Angular application can customize cookie and header names by providing its own `CookieXSRFStrategy` values.
  
positive.code: 
    :marked
      If you need to convert user input into a trusted value, use a
      controller method. The template below allows users to enter a YouTube video ID and load the
      corresponding video in an `<iframe>`. The `<iframe src>` attribute is a resource URL security
      context, because an untrusted source can, for example, smuggle in file downloads that unsuspecting users 
      could execute. So call a method on the controller to construct a trusted video URL, that causes
      Angular to then allow binding into `<iframe src>`:
  
    +makeExcerpt('src/app/bypass-security.component.html', 'iframe')
    +makeExcerpt('src/app/bypass-security.component.ts ()', 'trust-video-url')
  
negative.code: block includes
    include ../_util-fns
  :marked
    This page describes Angular's built-in
    protections against common web-application vulnerabilities and attacks such as cross-site
    scripting attacks. It doesn't cover application-level security, such as authentication (_Who is
    this user?_) and authorization (_What can this user do?_).
  
    For more information about the attacks and mitigations described below, see [OWASP Guide Project](https://www.owasp.org/index.php/Category:OWASP_Guide_Project).
  
  +ifDocsFor('ts')
    .l-main-section
    :marked
      # Contents
  
      * [Reporting vulnerabilities](#report-issues).
      * [Best practices](#best-practices).
  