When there are URLs defined in some dependency file (e.g. Gemfile,
gemspec, etc), they get converted to links. We are not sanitizing
it so if some `javascript:` code is added as a URL, it can cause
XSS vulnerability.