Will It Vibe?raw() helper applied to request-influenced content
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
The raw view helper outputs a string unescaped, the same effect as .html_safe. Called on something built from params with no sanitize call on the same line, client-submitted HTML or script renders verbatim in the page.
Why it matters
The raw helper has the same effect as .html_safe: it disables escaping for that output. Applied to something built from params, a client-submitted script tag or HTML attribute renders and executes exactly as written, in every browser that loads the page.
How to fix it
Remove the raw() call around the params-derived value. If limited HTML needs to render, pass the value through sanitize with an explicit tags/attributes allowlist first. If no HTML is needed, drop raw entirely and let the default escaping handle it.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo