Self XSS when sending HTML as a comment in the Deck app