I Let Users Write HTML Templates - Here Are 6 Security Holes I Had to Patch

Four months ago, I set myself a challenge: launch a SaaS that solves a pain point from my previous job. PDF generation from templates. The result is TemplateFox . In 2026, you don't build alone. Claude wrote most of the code. I understand how it all works conceptually, but I couldn't tell you every implementation detail. One week before launch, I blocked the week to stress-test the whole codebase for security. Spoiler: out of the box, Claude Code hadn't applied a single security prevention. To be honest, it wasn't in my CLAUDE.md, and that was intentional. I was building a WYSIWYG editor with HTML templating, and I didn't want the model second-guessing every line with sanitization that would break the core feature. So I never asked for it. Armed with Claude and a friend who works in cybersecurity, we went hunting. Claude caught most of the obvious holes I'll describe below. But for vulnerabilities 3 and 6, we had to feed it the attack path before it understood the problem. Here's what