Escape HTML in notification template variables

[Robert Bergman]

While tetra will sanitize any HTML coming through, we still need to make sure that email content doesn't interfere with the notification formatting.

[Robert Bergman]

Now using handlebars to render notifications.