Rendering Untrusted Content

Template engines autoescape by default, so the vulnerable surface is small and enumerable: it is exactly the places where something says this value is already safe HTML. Find those first; everything else is already handled.

Step 1 — Enumerate the trust bypasses

# Server-side (Jinja/Django templates + the Python that feeds them)
grep -rnE '\|\s*safe|Markup\(|autoescape false|mark_safe' templates/ src/

# Client-side
grep -rnE 'innerHTML|outerHTML|insertAdjacentHTML|document\.write' web/ static/

Every hit is a claim that needs justification. A |safe on a value that came from a database column is a claim about everything that has ever been written to that column, including via an import path nobody remembers.