🐐 Several security fixes

backend/services/email_utils.py

@@ -1,4 +1,4 @@
-import os
+import html
 
 import resend
 
@@ -6,6 +6,8 @@ from core.config import RESEND_API_KEY, EMAIL_FROM, FRONTEND_URL
 
 def send_verification_email(to_email: str, username: str, token: str):
   resend.api_key = RESEND_API_KEY
+  # Usernames are only length-checked at registration, so they can contain markup.
+  username = html.escape(username)
   verify_url = f"{FRONTEND_URL}/verify-email?token={token}"
 
   resend.Emails.send({
@@ -31,6 +33,7 @@ def send_verification_email(to_email: str, username: str, token: str):
 
 def send_password_reset_email(to_email: str, username: str, reset_token: str):
   resend.api_key = RESEND_API_KEY
+  username = html.escape(username)
   reset_url = f"{FRONTEND_URL}/forgot-password/reset?token={reset_token}"
 
   resend.Emails.send({