From a726e5f1721f9bc031c2124e45a754d74bd77351 Mon Sep 17 00:00:00 2001
From: "a.tolmachev" <a.tolmachev@tbank.ru>
Date: Sat, 11 Apr 2026 23:36:05 +0300
Subject: [PATCH] docs: clarify unsafe error rendering case

---
 __REVIEW_FRONT.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/__REVIEW_FRONT.md b/__REVIEW_FRONT.md
index 9f4bafd..f762308 100644
--- a/__REVIEW_FRONT.md
+++ b/__REVIEW_FRONT.md
@@ -165,6 +165,14 @@ Actions:
   - safe toast body
   - pre-defined empty/error state templates
 
+Explicit case to fix:
+
+- `apps/ui/js/secrets.js`
+  - current pattern builds `profilesList.innerHTML` using `state.error`
+  - `state.error` is populated from caught API/fetch error text
+  - that makes server-provided message text an unsafe HTML source
+  - this renderer must be rewritten to build DOM nodes and place the message through `textContent`
+
 ### Acceptance Criteria
 
 - no API-provided field is rendered via raw `innerHTML`;