From bb5343ee9c562e7fcde04555264bcf90fee76399 Mon Sep 17 00:00:00 2001
From: Rob Bos <rajbos@users.noreply.github.com>
Date: Sat, 7 Feb 2026 23:03:20 +0100
Subject: [PATCH] Potential fix for code scanning alert no. 22: Client-side
 cross-site scripting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 src/webview/diagnostics/main.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/webview/diagnostics/main.ts b/src/webview/diagnostics/main.ts
index 5233f5a..784294d 100644
--- a/src/webview/diagnostics/main.ts
+++ b/src/webview/diagnostics/main.ts
@@ -291,7 +291,7 @@ function renderSessionTable(detailedFiles: SessionFileDetails[], isLoading: bool
 			</div>
 			<div class="summary-card">
 				<div class="summary-label">🔗 Context References</div>
-				<div class="summary-value">${totalContextRefs}</div>
+				<div class="summary-value">${safeText(totalContextRefs)}</div>
 			</div>
 			<div class="summary-card">
 				<div class="summary-label">📅 Time Range</div>