craft/src/panels/right/styles/HtmlStylePanel.test.tsx

@@ -35,4 +35,10 @@ describe('HtmlStylePanel', () => {
     expect(container.textContent).not.toContain('Padding');
     expect(container.textContent).not.toContain('Border Radius');
   });
+
+  test('renders the security advisory', () => {
+    render(<HtmlStylePanel selectedId="n1" nodeProps={{ code: '<p>x</p>', style: {} }} />);
+    expect(container.textContent).toContain('Use this block with care.');
+    expect(container.textContent).toContain('Scripts and event handlers are stripped');
+  });
 });

craft/src/panels/right/styles/HtmlStylePanel.tsx

@@ -25,6 +25,13 @@ export const HtmlStylePanel: React.FC<{ selectedId: string; nodeProps: Record<st
         Style this block inside your own markup — a wrapper set here would show
         in the editor but not on the published page.
       </p>
+      <p style={{ fontSize: 10, color: 'var(--color-text-dim)', lineHeight: 1.4, padding: '0 2px' }}>
+        <strong>Use this block with care.</strong> It renders your markup as-is
+        on the published site. Scripts and event handlers are stripped
+        automatically, but anything that survives — forms, iframes, images —
+        can still send data to wherever it points. Only paste code you
+        understand or trust.
+      </p>
     </>
   );
 };