fix: render dashboard domain rows safely

backend/app/tests/test_dashboard_template_security.py

@@ -0,0 +1,20 @@
+from pathlib import Path
+
+
+def test_dashboard_domain_table_uses_safe_dom_rendering():
+    """Domain names and counts come from report data and must not be HTML-rendered."""
+    template = (Path(__file__).resolve().parents[1] / "templates" / "index.html").read_text()
+    populate_start = template.index("populateDomainsTable(domains)")
+    helper_start = template.index("createDomainNameCell(domainName)")
+    populate_body = template[populate_start:helper_start]
+
+    assert "innerHTML" not in populate_body
+    assert ".textContent" in populate_body
+    assert "createDomainNameCell" in populate_body
+    assert "createDetailsCell" in populate_body
+
+
+def test_dashboard_domain_details_links_are_encoded():
+    template = (Path(__file__).resolve().parents[1] / "templates" / "index.html").read_text()
+
+    assert "encodeURIComponent(domainId)" in template