In reply to Nick.

It sounding like the same security risk may also exist in template parts and they just missed it, so make sure there’s no user-generated content in your template parts.