[P0] XSS in public site fallback renderer — user-controlled HTML injection

[ShadowWalkerNC]

Summary

In _render_public_site, the Jinja2 fallback path interpolates user-controlled SEO data directly into raw HTML without escaping:

f'<h1>{title}</h1>'  # title is user-controlled SEO data

Impact

Stored XSS. Any user who sets their SEO title to <script>alert(1)</script> will have that script execute in the browser of anyone who visits their public site page.

Fix

from markupsafe import escape

f'<h1>{escape(title)}</h1>'

Apply markupsafe.escape() to all user-controlled variables in the fallback HTML renderer (title, description, business name, etc.).

Effort: ~10 minutes

Part of full audit: #1