Two retained CodeQL findings outside the console:

• alert #3868 stores the installer URL capability secret in sessionStorage and sends it as X-Appwrite-Installer-Secret. It strips the URL query and supports reloads, but remains readable to same-origin scripts. Evaluate an HttpOnly capability/session exchange plus expiry and cleanup, with an installer E2E test. The scanner has not established a standalone exploit.
• alert #2463 escapes Markdown table pipes without first escaping backslashes. markdownText already escapes HTML metacharacters and removes newlines. Treat as benchmark report formatting correctness unless another sink changes the threat model.

Alert links: https://github.com/appwrite/appwrite/security/code-scanning/3868 and https://github.com/appwrite/appwrite/security/code-scanning/2463. Reviewed at ac7f088. Parent: #14675.