01 · Before and afterThe pattern
// before: request fires here, before the node is ever attached
const img = document.createElement("img");
img.src = untrustedUrl;
template.content.append(img);
// after: create in the template's inert document
const inert = template.content.ownerDocument;
const img = inert.createElement("img");
img.setAttribute("src", untrustedUrl); // no network request02 · Run it on your appThe check
Does your app ever set src on an element built from someone else's HTML before sanitising it, even off-screen?
If the honest answer is no or not sure, this is worth a look before it reaches production.