Security Finding (Informational) SEC-028: Twig Template Uses `|raw` Filter for Menu Rendering

[DyanGalih]

Finding ID: SEC-028
Location: templates/layout/main.html.twig

Template uses {{ render_menu() | raw }}, rendering menu output without escaping. If MenuExtension::renderMenu() does not properly escape user-controlled content, this may lead to stored XSS.

Impact: Potential stored XSS via menu names/URLs.

Remediation (short): Ensure MenuExtension::renderMenu() properly escapes dynamic content or avoid |raw and rely on Twig escaping.

Reference: SECURITY_REVIEW.md