Source code
Security & compliance
HTML injection
Part of the Email safety check · fix arrives as a guide
What it is
User-supplied text is interpolated into an HTML email template without escaping.
Why it matters
Mail clients render enough HTML for this to matter — an injected link or a spoofed block of content can make a phishing message look like it came from your product, delivered by your own sending domain.
How to fix it
Escape all interpolated values in HTML templates, or use a templating engine that escapes by default. Where users legitimately supply rich text, sanitise it against an allow-list of tags and attributes.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.