diff --git a/crates/ruff_linter/src/rules/flake8_bandit/rules/mako_templates.rs b/crates/ruff_linter/src/rules/flake8_bandit/rules/mako_templates.rs
index 32f695263cad9..8d963335ec3e7 100644
--- a/crates/ruff_linter/src/rules/flake8_bandit/rules/mako_templates.rs
+++ b/crates/ruff_linter/src/rules/flake8_bandit/rules/mako_templates.rs
@@ -11,21 +11,21 @@ use crate::checkers::ast::Checker;
 /// ## Why is this bad?
 /// Mako templates allow HTML and JavaScript rendering by default, and are
 /// inherently open to XSS attacks. Ensure variables in all templates are
-/// properly sanitized via the `n`, `h` or `x` flags (depending on context).
-/// For example, to HTML escape the variable `data`, use `${ data |h }`.
+/// properly escaped via the `h` (HTML) or `x` (XML) filters, depending on
+/// context. For example, to HTML escape the variable `data`, use `${ data |h }`.
 ///
 /// ## Example
 /// ```python
 /// from mako.template import Template
 ///
-/// Template("hello")
+/// Template("${ data }")  # Unescaped: vulnerable to XSS.
 /// ```
 ///
 /// Use instead:
 /// ```python
 /// from mako.template import Template
 ///
-/// Template("hello |h")
+/// Template("${ data |h }")  # HTML-escaped with the `h` filter.
 /// ```
 ///
 /// ## References