[timebomb]

Cool! Looks like HTML injection isn't blocked whatsoever. With chat messages being loaded as people enter, it could lead to someone exploiting everyone that enters your site.

[nerdburn]

Ha, good catch! It's just a toy at this point, but we'll fix that asap.