<commit_before># Secure GAE Scaffold

## Introduction
----
Please note: this is not an official Google product.

This contains a boilerplate AppEngine application meant to provide a secure
base on which to build additional functionality.  Structure:

* / - top level directory for common files, e.g. app.yaml
* /js - directory for uncompiled Javascript resources.
* /src - directory for all source code
* /static - directory for static content
* /templates - directory for Django/Jinja2 templates your app renders.
* /templates/soy - directory for Closure Templates your application uses.

Javascript resources for your application can be written using Closure,
and compiled by Google's Closure Compiler (detailed below in the dependencies
section).

The scaffold provides the following basic security guarantees by default through
a set of base classes found in `src/base/handlers.py`.  These handlers:

1. Set assorted security headers (Strict-Transport-Security, X-Frame-Options,
   X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy) with
   strong default values to help avoid attacks like Cross-Site Scripting (XSS)
   and Cross-Site Script Inclusion.  See  `_SetCommonResponseHeaders()` and
   `SetAjaxResponseHeaders()`.
1. Prevent the XSS-prone construction of HTML via string concatenation by
   forcing the use of a template system (Django/Jinja2 supported).  The
   template systems have non-contextual autoescaping enabled by default.
   See the `render()`, `render_json()` methods in `BaseHandler` and
   `BaseAjaxHandler`. For contextual autoescaping, you should use Closure<commit_msg>Update README with a link to the Python 3 secure scaffold<commit_after># Secure GAE Scaffold for Python 2

## Introduction
----
Please note: this is not an official Google product.

*This scaffold is for users of App Engine's Python 2.7 runtime. For websites
deployed to the Python 3 runtime, please see [Secure Scaffold for Python 3](https://github.com/google/gae-secure-scaffold-python3).*

This contains a boilerplate AppEngine application meant to provide a secure
base on which to build additional functionality.  Structure:

* / - top level directory for common files, e.g. app.yaml
* /js - directory for uncompiled Javascript resources.
* /src - directory for all source code
* /static - directory for static content
* /templates - directory for Django/Jinja2 templates your app renders.
* /templates/soy - directory for Closure Templates your application uses.

Javascript resources for your application can be written using Closure,
and compiled by Google's Closure Compiler (detailed below in the dependencies
section).

The scaffold provides the following basic security guarantees by default through
a set of base classes found in `src/base/handlers.py`.  These handlers:

1. Set assorted security headers (Strict-Transport-Security, X-Frame-Options,
   X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy) with
   strong default values to help avoid attacks like Cross-Site Scripting (XSS)
   and Cross-Site Script Inclusion.  See  `_SetCommonResponseHeaders()` and
   `SetAjaxResponseHeaders()`.
1. Prevent the XSS-prone construction of HTML via string concatenation by
   forcing the use of a template system (Django/Jinja2 supported).  The
   template systems have non-contextual autoescaping enabled by default.
   See the `render()`, `render_json()` methods in `BaseHandler` and
   `BaseAjaxHandler`. For contextual autoescaping, you should use Closure
{'fraction_non_alphanumeric': 0.06742857142857143, 'fraction_numerical': 0.004285714285714286, 'mean_word_length': 4.453271028037383, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1808151', 'n_tokens_mistral': 955, 'n_tokens_neox': 887, 'n_words': 422}