Originally posted by @Ocramius in #376 (comment)

We should look into getting rid of string replacements, and using DOM manipulation for HTML replacements, where possible.

This is NOT a security issue because this tool is intended for use on repository sources, NOT user input.