Your project must not use features which can be used to extract data from your users 2

More information: https://insight.symfony.com/what-we-analyse/twig.xss_vulnerability

in templates/bundles/TwigBundle/Exception/error.html.twig, line 14 
  1.             <p>{{ 'error.description'|trans|format(path('index'))|raw }}</p>
  2.             {% if exception is defined %}
  3.                 <hr>
  4.                 <div class="d-flex align-items-baseline gap-2">
  5.                     <div class="text-nowrap">{{ 'error.message'|trans }}</div>
  6.                     <div>{{ exception.message|raw }}</div>
    Using the |raw filter or the {% autoescape false %} block in a Twig template exposes users to Cross-Site Scripting (XSS) attacks
    Time to fix: about 3 hours
    Read doc
                Open Issue
             Permalink Copy Prompt
    
                                    Last edited  by Bibi
                    
  7.                 </div>
  8.             {% endif %}
  9.         </div>
  10.     </div>
  11. {% endblock body %}
in templates/index.html.twig, line 40 
  1.                         {{- _self.output_level(levels, levels.ERROR, 'result.error'|trans) -}}
  2.                     </a>
  3.                     <div id="details" class="collapse">
  4.                         <hr>
  5.                         <ul class="list-unstyled ms-3 mb-0">
  6.                             <li>{{- _self.output_level(levels, levels.ERROR, result.message|raw) -}}</li>
    Using the |raw filter or the {% autoescape false %} block in a Twig template exposes users to Cross-Site Scripting (XSS) attacks
    Time to fix: about 3 hours
    Read doc
                Open Issue
             Permalink Copy Prompt
    
                                    Last edited  by Bibi
                    
  7.                         </ul>
  8.                     </div>
  9.                 </div>
  10.             {% elseif result and result.success %}
  11.                 <div class="alert alert-light" role="alert">

Your project must not contain invalid instantiations

More information: https://insight.symfony.com/what-we-analyse/php.invalid_instantiation

in public/index.php, line 18 
  2. use App\Kernel;
  4. require_once \dirname(__DIR__) . '/vendor/autoload_runtime.php';
  6. return fn (array $context) => new Kernel($context['APP_ENV'], (bool) $context['APP_DEBUG']);
    Parameter #1 $environment of class App\Kernel constructor expects string, mixed given.
    Time to fix: about 1 hour
    Read doc
                Open Issue
             Permalink Copy Prompt
    
                                    Last edited  by Laurent Muller

Your project should not contain PHP files defining multiple classes

More information: https://insight.symfony.com/what-we-analyse/php.file_contains_more_than_one_class

in config/reference.php
This file contains 2 classes. Keeping only one class per file is a standard in the PHP community, since it promotes interoperability and maintainability.
Time to fix: about 4 hours
Read doc Open Issue Permalink Copy Prompt
Last edited by Laurent Muller