I wonder how they prevent Remote Code Execution. Because >just embed arbitrary html/css/js is THE definition of RCE.