Hi @dahanoo, welcome to the Streamlit community!
This is a great question…we refer to HTML as “unsafe” as a keyword argument, to highlight the fact that you can run JavaScript within the widget.
We’re highlighting the fact that Streamlit itself will not be able to prove the code’s safety, since a malicious 3rd-party could inject code into your website, or the Streamlit app creator might write code in such a way as to allow for code injection attacks. So by default, we disable evaluating code inside of an HTML snippet, but allow a user to set the keyword argument to say “I understand that this is potentially risky, but I want to do it anyway”