The extension does two things:
- It sends sha1 of the url to the data server to check the numebr of comments, but doesn't pull the comments.
- It renders an <iframe src="comntr.github.io#foobar.com"> to show the comments.
Thus the extension has very little code and doesn't need much updates.
So answer is yes. The database does not sanitize user input and the extension just renders the tags as actual HTML. That doesn't seem super safe. I mean just check the example page from the github. It already has embedded Youtube videos and gifs.