fix: safety is html_safe