You might have heard of the recent security incident on some instances – that specific xss fix had been added to this instance in advance. However, there are no custom emojis yet, which was the source of that incident. But .... I'll likely add some soon. :)