I'm unsure about this behavior. This seems insecure as you write the response to the DOM