EntityCodec is a representation tool for inspected text. It cannot know the receiving parser, templating framework, quote state, URL scheme or trust boundary, so it must not be used as a sanitizer or security certificate.
Context determines escaping
Encoding angle brackets can be useful in an HTML text node, but it does not validate a URL, make a script string safe, or remove dangerous markup from a document fragment.
Use the receiving framework
Prefer the receiving framework's ordinary text binding and reviewed sanitization APIs. Avoid bypass APIs and never insert EntityCodec output with an unsafe raw-HTML operation merely because it contains references.
Verify the exact destination
Character-reference encoding changes text representation, not the trust level of the data. Keep the output as text until the receiving system applies the correct context-specific escaping or sanitization. Compare the complete result after pasting it into that system. For a repeatable check, keep one literal fixture beside its expected encoded form, run the same selected profile twice, and compare every ampersand, semicolon, code point, space, and line break. Then test the receiving text binding with harmless representative characters. If the destination rewrites, normalizes, repeatedly decodes, or renders the value, document that later behavior separately because it is outside EntityCodec.