ERB Escape Audit - Rails XSS lint

It reads Rails .erb templates and reports every line where HTML escaping was switched off or was the wrong escaping for the context: raw, .html_safe, the <%== tag, render inline:, interpolation inside script or style blocks, href and on-event attributes, unquoted attributes, content_tag with escape false, and sanitize without an allowlist. Fifteen rules, each naming the helper that fixes the line.

Rails developers who ship server-rendered views, and the person who reviews those views before a release. It is most useful on codebases where an AI assistant writes template code, because assistants reach for raw and html_safe to make markup render and the result looks correct in the browser either way.

Ruby linters parse Ruby, so they see the ERB tag but not the HTML around it. Whether a value needs j, json_escape, a quoted attribute or a scheme check depends on that surrounding markup. Static scanners that do know Rails flag raw and html_safe but not an unquoted src attribute or interpolation inside a style block.

Auditing the file you have open is free and complete: every finding, every line number, every fix, no cap and no watermark. The licence covers a different axis, scope and ownership. It sweeps every .erb file in the workspace in one run and writes a dated Markdown or CSV report you keep as evidence.

A freelance Rails developer doing the same template review bills $75 to $150 an hour on the open market, and a mid-sized app has hundreds of .erb files. The extension is $29 once, one licence key per person or CI seat, with a seven-day full refund.