Retain 16 console findings for remediation/review:

• OAuth sessionStorage: alert #4051 and alert #4048 contain authorization codes, codeVerifier and optional OAuth client credentials. Review cleanup, lifetime and a server-side exchange; scanner evidence alone does not prove disclosure.
• Iframe URL alert #4031: withAutoplay permits arbitrary schemes, and docs Markdoc src/blog data attributes reach the player. Restrict to parsed HTTPS YouTube hosts/IDs. Establish an untrusted content writer before calling this exploitable XSS.
• Regex alert #4027 / alert #4028: package/bundle-ID validation has overlapping dot repetitions; blog list-link preprocessing has ambiguous nested repetitions. Rewrite for bounded input processing and test adversarial lengths. Blog input is currently repository content.
• Host classification alert #4067 / alert #4078 / alert #4079 / alert #4086: parse hostnames rather than substring-checking Cloud endpoints or acquisition referrers. Preserve regional hosts. These are UI/analytics correctness issues, not a demonstrated server authorization bypass.
• Raffle alert #4044: Math.random selects promotional winners. Review suitable randomness and whether authoritative selection belongs server-side; this is integrity/fairness hardening.
• Markdown alert #4038–alert #4043: escape backslashes before pipes. Treat as formatting correctness unless an unsafe downstream renderer introduces an injection boundary.

Alert links: https://github.com/appwrite/appwrite/security/code-scanning (search by the IDs above). Reviewed at ac7f088. Parent: #14675.