From 07077c8cf640385c34d514a549f8ce0c02b30cee Mon Sep 17 00:00:00 2001
From: Jay Greenberg <PhaedrusTheGreek@users.noreply.github.com>
Date: Fri, 23 Feb 2018 17:19:59 -0500
Subject: [PATCH] Update README.md

---
 README.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 9ba07ba..6f6edee 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,9 @@ From the Javascript object, they're available via `this`, e.g., `this.response`
 
 ## Support for Javascript
 
-By default, no unsafe HTML (such as `<style> tags`) will be allowed, as processed by Angular's [$sanitize](https://docs.angularjs.org/api/ngSanitize/service/$sanitize) , but Javascript processing can be achieved by acknowledging the client-side security risk in `kibana.yml` with `transform_vis.allow_unsafe: true`.   When enabled, a "Javscript" box appears that allows you to create a special object that will be merged with the query's response object under the field name `meta`.
+By default, no unsafe HTML (such as `<style>` tags) will be allowed, as processed by Angular's [$sanitize](https://docs.angularjs.org/api/ngSanitize/service/$sanitize) , but Javascript processing can be achieved by acknowledging the client-side security risk in `kibana.yml` with `transform_vis.allow_unsafe: true`.   When enabled, a "Javscript" box appears that allows you to create a special object that will be merged with the query's response object under the field name `meta`.  
+
+`<script>` tags will not be evaluated.  
 
 Any Javascript given will be executed by the web browser, however in order to be merged with the query response object for processing by Mustache, you must prepare an Object, enclosed by parentheses like this: