I disable htmx.config.allowScriptTags, which is true by default and "determines if htmx will process script tags found in new content". Also htmx.config.selfRequestsOnly which prevents cross-origin requests.

https://v2-0v2-0.htmx.org/reference/#config