Windsurf
ui
Cascade Introduced XSS Vulnerability in Templates
Cross-site scripting (XSS) vulnerability introduced in Cascade-generated templates. User input is rendered without HTML escaping, allowing attackers to inject malicious JavaScript that runs in other users' browsers.
This is a critical security issue requiring immediate fix.
Error Messages You Might See
<script>alert('XSS')</script> executed in browser
XSS vulnerability found in template
Unsanitized user input in HTML
Common Causes
- Cascade used th:utext='${variable}' instead of th:text for unescaped output
- User comment or name rendered directly without sanitization
- Cascade removed HTML escaping in frontend template or disabled it
How to Fix It
Use th:text='${variable}' instead of th:utext to enable HTML escaping. Sanitize user input server-side if HTML is needed. Use security libraries like OWASP ESAPI or DOMPurify for sanitization. Never render user input directly without escaping. Review all template variables for proper escaping.
Real developers can help you.
Luca Liberati
I work on monoliths and microservices, backends and frontends, manage K8s clusters and love to design apps architecture
Costea Adrian
Embedded Engineer specilizing in perception systems. Latest project was a adas camera calibration system.
Jared Hasson
Full time lead founding dev at a cyber security saas startup, with 10 yoe and a bachelor's in CS. Building & debugging software products is what I've spent my time on for forever
Rudra Bhikadiya
I build and fix web apps across Next.js, Node.js, and DBs.
Comfortable jumping into messy code, broken APIs, and mysterious bugs.
If your project works in theory but not in reality, I help close that gap.
Basel Issmail
’m a Senior Full-Stack Developer and Tech Lead with experience designing and building scalable web platforms. I work across the full development lifecycle, from translating business requirements into technical architecture to delivering reliable production systems.
My work focuses on modern web technologies, including TypeScript, Angular, Node.js, and cloud-based architectures. I enjoy solving complex technical problems and helping teams turn product ideas and prototypes into working platforms that can grow and scale.
In addition to development, I often collaborate closely with product managers, business analysts, designers, and QA teams to ensure that solutions align with both technical and business goals.
I enjoy working with startups and product teams where I can contribute both as a hands-on engineer and as a technical partner in designing and delivering impactful software.
AUXLE
I am a Full Stack Developer experienced in building Websites, Web apps and Cross Platform Mobile Apps for Startups and Companies.
Simon A.
I'm a backend developer building APIs, emulators, and interactive game systems. Professionally, I've developed Java/Spring reporting solutions, managed relational and NoSQL databases, and implemented CI/CD workflows.
Omar Faruk
As a Product Engineer at Klasio, I contributed to end-to-end product development, focusing on scalability, performance, and user experience.
My work spanned building and refining core features, developing dynamic website templates, integrating secure and reliable payment gateways, and optimizing the overall system architecture.
I played a key role in creating a scalable and maintainable platform to support educators and learners globally.
I'm enthusiastic about embracing new challenges and making meaningful contributions.
Meïr Ankri
Full-stack developer specializing in React / Next.js / Node.js with 6+ years of experience. I've worked across various sectors including automotive (Reezocar/Société Générale), healthcare (Medical Link SaaS), and e-commerce (Glasman). I build web apps end-to-end, from architecture to production, with a focus on scalability, performance, and code quality. I also mentor junior developers and contribute to technical decisions and code reviews.
Anthony Akpan
Developer with 8 years of experience building softwares fro startups
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get HelpFrequently Asked Questions
How do I prevent XSS in templates?
Always escape user input. Thymeleaf: use th:text not th:utext. Never render user data as HTML.
When should I use utext?
Only if you control the HTML content (static content from database). Never with user-provided input.