- Raw output ERB tags of the form
<%== ... %>are now recognised as cross-site scripting sinks. - The name "certification" is no longer seen as possibly being a certificate, and will therefore no longer be flagged in queries like "clear-text-logging" which look for sensitive data.