That is not what I said.

What I said, is that if there was a flaw in GitHub's code that propagated a XSS or CSRF, then we would have an exposure.

That is not the same as allowing arbitrary scripts which could be intentionally written with a XSS or CSRF vector.