Hmmm, won't it fail for smth like '<<img src=hack onerror=alert(haaacked)>'? Do we have something security\sanitize related in the shared\js to be reused across the apps?