# jinja2.exceptions.SecurityError: autoescape is disabled, but Markup is used

- **ID:** `python/flask-jinja-autoescape-off`
- **Domain:** python
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

Using Markup or |safe on untrusted data with autoescape disabled, Jinja raises a security error in strict mode.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (93% success)
   ```
   app.jinja_env.autoescape = select_autoescape(['html', 'xml'])
   ```
2. **** (90% success)
   ```
   Sanitize with bleach.clean(html, tags=[...]) before marking safe
   ```

## Dead Ends

- **** — Breaks legitimate HTML rendering; templates show escaped tags. (50% fail)
- **** — Unrelated setting; error persists. (80% fail)