Hacker News Reader

Doesn't the regex sanitize it before display?

Yes but it's pretty easily bypassed

How is it easily bypassed?

I asked earlier because I'm genuinely curious, but do you have a payload that would bypass this particular regex?