EJS 6

Apply the Node.js 24 prompt first. These rules target EJS 6 on Node.js 24 and were checked against 6.0.1; apply the browser-delivery rule when shipping EJS to clients.

Template and option authority

• Treat templates passed to ejs.compile() or ejs.render() and files loaded by ejs.renderFile(), including loader-produced partials, as application code. Never compile user-authored content or recompile rendered output, even after HTML sanitization.
• Supply a separate, developer-owned options object to ejs.render(template, viewModel, options) and ejs.renderFile(filename, viewModel, options[, callback]). The two-argument render() form and renderFile() without explicit options promote selected data properties into engine options.
• Construct locals from explicitly selected fields; never pass req.query, req.body, or an unrestricted spread of input directly to a rendering API. Keep compiler settings, callbacks, and delimiter choices outside the user-controlled view model.
• Keep Express settings, settings['view options'], and option-bearing app.locals, res.locals, and render locals server-owned. EJS reads view paths and caching from settings, copies view options, and then lets recognized top-level locals override them. Use an app.engine() adapter that calls ejs.renderFile(path, data, trustedOptions, callback) when options must be independent of these locals.

Locals and execution context

• Keep unsafePrototypeLocals: false, the v6 default. EJS copies own enumerable locals to an object without a prototype; project required class properties