So answer is yes. The database does not sanitize user input and the extension just renders the tags as actual HTML. That doesn't seem super safe. I mean just check the example page from the github. It already has embedded Youtube videos and gifs.