Case-report templates can be uploaded by customer_user (the lowest-privilege portal role) and are later rendered by a non-sandboxed Jinja2 engine when an admin or analyst generates a report. Because ...