Jinja 3.1

Apply the Python 3 baseline first. These rules cover Jinja 3.1 autoescaping, trusted markup, template-source trust, sandbox limits, loaders, context design, and deployment.

Environment and autoescaping

• Create one reviewed Environment(autoescape=select_autoescape(...)); include every HTML/XML suffix, set default_for_string=True for string templates, and choose the default for unknown suffixes explicitly.
• Do not rely on the bare Environment default because autoescaping is not universally enabled by default.
• Keep autoescape state explicit for string templates and nonstandard template filenames; review every {% autoescape false %} block as an escaping bypass.
• Use StrictUndefined where silently missing values could weaken security or expose the wrong tenant's data.
• Keep environment globals, filters, tests, extensions, and finalize callbacks minimal and trusted; configure them before loading templates.
• Pass request and tenant data to Template.render() or render_async(), never to Environment.globals, Template.globals, or get_template(globals=...); get_template updates cached template globals.
• In custom HTML-producing filters, check eval_ctx.autoescape through @pass_eval_context and escape untrusted fragments before returning Markup.
• Do not use Environment.overlay() as a tenant or privilege boundary: it shares the parent environment's data except its cache and overridden attributes, and inherited extensions cannot be removed.

Output and trusted markup

• Pass untrusted values as template data and let autoescaping encode them