Is Web Design safe?

The component can run operating-system commands or spawn processes.

result = subprocess.run(
            ["curl", "-Ls", "--max-time", str(timeout), url],
            capture_output=True,
            text=False,
            check=True,
        )

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.

The component reads files from disk.

return Path(source).read_text(encoding="utf-8")

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

with open(output / "tokens.json", "w", encoding="utf-8") as f:

with open(output / "structure.json", "w", encoding="utf-8") as f:

with open(output / "styles.css", "w", encoding="utf-8") as f:

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

The component makes outbound network requests.

from urllib.parse import urljoin, urlparse

from urllib.request import Request, urlopen

request = Request(url, headers={"User-Agent": USER_AGENT})

with urlopen(request, timeout=timeout) as response:

parsed = urlparse(source)

parsed_ref = urlparse(ref)

parsed_base = urlparse(base_source)

return urljoin(base_source, ref)

path = urlparse(cleaned).path.lower()

if not fetch_external or not resolved or urlparse(resolved).scheme == "data":

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.