{% comment %} The repeatable keyword list. `json_script` is a security control, not a convenience. Keyword text is user-authored and a keyword containing `` interpolated straight into an x-data attribute is stored XSS (SECURITY-BASELINE §2). json_script emits it as escaped JSON inside a script tag the browser will not execute, and Alpine reads it back with JSON.parse. The rows post two parallel lists, keyword_text and keyword_mode. The view zips them with strict=True and refuses a length mismatch rather than pairing off a truncated list — see apps/flows/triggers/forms.py. {% endcomment %} {{ config.keywords|default_if_none:""|json_script:"trigger-keyword-rows" }}
Matching ignores case and surrounding spaces. “Contains” matches inside a word, “whole word” does not.