If it's a React frontend, unless it put __dangerouslySetInnerHtml in there to render HTML received from the API, the frontend is likely going to be perfectly secure.