A kind user pointed out that arbitrary HTML can be inserted via the Live client. Will need to see what can be done and make sure things like XSS do not work!