It is possible to inject Javascript into the Incident:
![image](https://user-images.githubusercontent.com/35271072/83534896-b2ad5900-a4f1-11ea-90f7-5dd87dd16748.png)
This results in the following:
![image](https://user-images.githubusercontent.com/35271072/83534955-c35dcf00-a4f1-11ea-815d-44d399ff341e.png)
This is a huge security risk as your website is at risk of running unwanted javascript code on visit which could lead to critical security risks!
Please sanitize "<" AND ">" server-side before saving the incident!