# F-077 — Implementer evidence: Product short description renders HTML in admin product list

## Problem

The admin product listing rendered `p.description` as plain text. HTML tags like `<strong>`, `<em>` were shown as literal text (e.g., `<strong>Fresh</strong>`) instead of formatted text (**Fresh**).

## Changes

`project/apps/admin/src/app/(dashboard)/products/page.tsx`:
- Added `renderHtml(html)` helper function:
  - Strips `<script>` tags (XSS vector)
  - Strips `on*="..."` event handler attributes (XSS vector)
  - Strips `javascript:` URLs
  - Strips `<iframe>`, `<object>`, `<embed>` tags
  - Preserves safe formatting tags: `<b>`, `<i>`, `<em>`, `<strong>`, `<br>`, `<p>`, `<span>`, `<u>`, etc.
- Replaced `{p.description?.slice(0, 60) ?? p.slug}` with `dangerouslySetInnerHTML={{ __html: renderHtml(p.description ?? '').slice(0, 60) || p.slug }}`
- The `truncate` CSS class still works on the rendered HTML

## Verification

- `npx tsc --noEmit` admin — exit 0 ✅
- `npx eslint` on changed file — exit 0 ✅
- `./scripts/verify.sh` — exit 0 ✅

## Files touched

```
project/apps/admin/src/app/(dashboard)/products/page.tsx   (modified)
work/artifacts/F-077/implementer.md                     (this file)
```