The new richText: true flag is a pure UI hint. The value is stored as plain HTML in the same CmsContent.value column as any other text field.
Sanitisation on both sides
We run DOMPurify both when an admin saves and when a public page renders. So even if someone managed to land HTML via a direct DB write or an imported snapshot, anything dangerous is stripped before the browser sees it.
What about export?
The export snapshot is one HTML string per key. JSON escapes quotes automatically — a bit verbose, but it round-trips perfectly.