Timesheet.js
The code is potentially vulnerable to XSS injections[1].[1] https://github.com/sbstjn/timesheet.js/blob/master/source/ja...edit: Thanks for the downvotes, lesson learned! Never talk about vulnerabilities of a code which is #1 on HN and people will blindly put in production.edit 2: So here is my new comment: "Awesome library! The fact that users can easily enhance its behaviour by using   tags in labels is a great feature!"