RBAC (optional)URL copied

Security FeaturesURL copied

• HTML escaping: Code blocks automatically escaped via html.escape()
• External link protection: rel="noopener noreferrer" on external links
• Path validation: Relative path resolution checks if resolved path is within root
• Session-based auth: Uses Starlette sessions, not exposed in URLs
• CSRF protection: Forms use POST with enctype="multipart/form-data"