Neat little project, but you can pass HTML tags directly into the chat! <script> doesn't seem to run, but <img> can load from external sites. Be careful!
Edit: this focuses on script tags and other means to inject code, but most defenses also work for other injected tags
first time figuring out opsec !