diff --git a/frontend/src/pages/Dashboard.tsx b/frontend/src/pages/Dashboard.tsx
index dae402b..3bcc934 100644
--- a/frontend/src/pages/Dashboard.tsx
+++ b/frontend/src/pages/Dashboard.tsx
@@ -23,9 +23,17 @@ function formatAge(iso: string): string {
   return `${Math.floor(hours / 24)}d ago`
 }
 
+function escHtml(s: string): string {
+  return s
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+}
+
 function renderContent(text: string) {
   return text.split('\n').map((line, i) => {
-    const processed = line.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
+    const safe = escHtml(line)
+    const processed = safe.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
     if (line.startsWith('- ') || line.startsWith('* ')) {
       return (
         <div key={i} style={{ display: 'flex', gap: 8, marginBottom: 4 }}>