If you look at the source, they're actually disabling the XSS protections in the browser:
# Disable the reflected XSS filter for demonstration purposes
self.response.headers.add_header("X-XSS-Protection", "0")
# Disable the reflected XSS filter for demonstration purposes
self.response.headers.add_header("X-XSS-Protection", "0")
Example: ?a=<script>void('&b=');alert('XSS')</script>
The value of a is <script>void(' and the value of b is ');alert('XSS')</script>.