Fix XSS vulnerability in activity card rendering

[Copilot]

Addresses XSS vulnerability where activity names, descriptions, and participant emails were interpolated directly into HTML via innerHTML, allowing potential script injection.

Changes

Replaced innerHTML with DOM API methods

• Used createElement(), textContent, and createTextNode() to construct activity cards
• Eliminated all template literal HTML string interpolation
• User-controlled data now rendered as text nodes, preventing HTML/JS execution

Removed data attributes in favor of closures

• Event handlers now capture activity/email data via closures instead of storing in DOM attributes
• Eliminates potential attribute injection vectors

Enhanced accessibility

• Added role="button", aria-label, and tabindex="0" to delete icons
• Implemented keyboard support (Enter/Space) for delete actions

Example

Before:

activityCard.innerHTML = `
  <h4>${name}</h4>
  <p>${details.description}</p>
  <span data-email="${email}">🗑️</span>
`;

After:

const title = document.createElement("h4");
title.textContent = name;
activityCard.appendChild(title);

const description = document.createElement("p");
description.textContent = details.description;
activityCard.appendChild(description);

Screenshot

CodeQL: 0 alerts

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.