Commit messages with HTML in them aren't sanitized, which can lead to bad things if a user doesn't close a tag within their message. 