I reported a simple XSS attack as an issue, might be worth a decent audit to make sure there are no other potential holes.