chore: remove vuln hints

Author: snoopysecurity

dvws-svelte/src/routes/(app)/admin/users/create/+page.svelte

@@ -16,14 +16,11 @@
     responseMessage = '';
     
     try {
-      // VULN: No CSRF token
-      // Training objective: CSRF on privileged operation
       const { data } = await apiClient.post('/api/v2/admin/create-user', 
         JSON.stringify({ username, password, admin: isAdmin }),
         { headers: { 'Content-Type': 'application/json' }}
       );
       
-      // VULN: Unescaped response
       responseMessage = `User ${username} created successfully!`;
       username = '';
       password = '';
@@ -71,7 +68,6 @@
 
     {#if responseMessage}
       <div class="mt-4 p-3 bg-blue-50 border border-blue-200 rounded">
-        <!-- VULN: Unescaped response message -->
         {@html responseMessage}
       </div>
     {/if}

dvws-svelte/src/routes/(app)/admin/users/status/+page.svelte

@@ -42,7 +42,6 @@
   </soapenv:Body>
 </soapenv:Envelope>`;
       
-      // VULN: SOAP XML Injection - backend may decode and re-inject
       const { data } = await apiClient.post('/dvwsuserservice', soapEnvelope, {
         headers: { 'Content-Type': 'text/xml' }
       });
@@ -51,8 +50,6 @@
       const parser = new DOMParser();
       const xmlDoc = parser.parseFromString(data, 'text/xml');
       
-      // VULN: Takes first match (.eq(0) equivalent)
-      // If attacker injects additional fields, this takes the injected ones first
       const usernameEl = xmlDoc.getElementsByTagName('username')[0];
       const roleEl = xmlDoc.getElementsByTagName('role')[0];
       const statusEl = xmlDoc.getElementsByTagName('status')[0];
@@ -82,7 +79,7 @@
       <div>
         <label class="block text-sm font-medium mb-2">Username</label>
         <Input bind:value={username} placeholder="Enter username to check" required />
-        <p class="text-xs text-yellow-600 mt-1">⚠️ VULN: SOAP XML Injection possible</p>
+
       </div>
 
       <div class="flex gap-2">