can we guarantee that `out` will never have xss in it?