Source code Security & compliance

HTML injection

Part of the Email safety check · fix arrives as a guide

What it is

User-supplied text is interpolated into an HTML email template without escaping.

Why it matters

Mail clients render enough HTML for this to matter — an injected link or a spoofed block of content can make a phishing message look like it came from your product, delivered by your own sending domain.

How to fix it

Escape all interpolated values in HTML templates, or use a templating engine that escapes by default. Where users legitimately supply rich text, sanitise it against an allow-list of tags and attributes.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.