# Blockcerts-verifier: Styling Whitelist
**URL:** https://community.blockcerts.org/t/blockcerts-verifier-styling-whitelist/2622
**Category:** Technical
**Created:** [September 16, 2020, 9:59pm UTC](https://community.blockcerts.org/t/blockcerts-verifier-styling-whitelist/2622 "2020-09-16T21:59:10Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ampatt97](https://community.blockcerts.org/u/ampatt97)
#### Post date: [September 16, 2020, 9:59pm UTC](https://community.blockcerts.org/t/blockcerts-verifier-styling-whitelist/2622/1 "2020-09-16T21:59:10Z")
I’ve managed to use inline styling to get a decent display html up and running. As we scale, building html for certs with incline styles is going to be quite time consuming. Does adding styles to the whitelist open availability to using those styles in a style tag or are the style tags always removed by the sanitizer when displaying.
Thanks in advance!
---
### Author:  [@lemoustachiste](https://community.blockcerts.org/u/lemoustachiste)
#### Post date: [September 23, 2020, 2:08pm UTC](https://community.blockcerts.org/t/blockcerts-verifier-styling-whitelist/2622/2 "2020-09-23T14:08:53Z")
Hi @ampatt97,
We made the choice to prevent `style` tags being part of `displayHTML` to reduce the amount of possible XSS attacks. Since a blockcerts can be sent to users and ran on their machine, we didn’t feel comfortable with the vulnerability.
At this point there is no reason to revisit, but an argumented and proven discussion as to why it is safe to have a `style` tag could convince us of the contrary.
We based this decision on this sheet: [https://owasp.org/www-community/xss-filter-evasion-cheatsheet](https://owasp.org/www-community/xss-filter-evasion-cheatsheet) but the sanitizer we use seems a bit more general.
---
### Author:  [@ampatt97](https://community.blockcerts.org/u/ampatt97)
#### Post date: [October 5, 2020, 9:21pm UTC](https://community.blockcerts.org/t/blockcerts-verifier-styling-whitelist/2622/3 "2020-10-05T21:21:23Z")
Are script tags removed as well?
---
### Author:  [@lemoustachiste](https://community.blockcerts.org/u/lemoustachiste)
#### Post date: [January 20, 2021, 2:34pm UTC](https://community.blockcerts.org/t/blockcerts-verifier-styling-whitelist/2622/4 "2021-01-20T14:34:10Z")
you bet they are, and for even more explicit reasons