Apparently I was part of a test where input sanitization was turned off. Reported and fixed before they could push it live.

Very "monkey on a typewriter". I was not even looking for security bugs, but studying usage of maia.css.

http://aster.or.jp/conference/icst2017/program/jmicco-keynot...