The /store handler in pkg/api/http/store.go doesn't set a Content-Type header, so Go sniffs HTML payloads and serves them as text/html. This allows stored XSS.

Ref: https://gist.github.com/kazisabu/27f3e272f474005001a9ecd2c258dbea