Hopefully fixed for good now. I discovered this past weekend that markdown-it-py doesn't disable HTML by default, so it was just happily accepting <script> tags. Good thing I haven't been antagonizing any leet haxors lately!