CodeQL Alert #46: Reflected server-side cross-site scripting

Code Snippet

    query = request.args.get('q', '')
    
    template = f"<h1>Search results for: {query}</h1>"
    return render_template_string(template)

@app.route('/profile')
def profile():

Classification: demo-only

This file is prefixed with vulnerable_ and is an intentionally insecure demo file for CodeQL demonstration purposes.

Generated by automated security triage on 2026-03-25.