If app name has html in it, it's rendered here. It would be necessary to escape this.

I tested this by manually changing an app name in the db.