I know that django escapes rendered strings, and after a couple of tests I did, I couldn't trigger an XSS alert, but could ``.html()`` evaluate something vulnerable?

Thoughts?