The todo app does not prevent xss.

Adding the following description to a task will demonstrate the issue:

<h1 onmouseover='alert(new Date())'>"Come on!"</h1>
<marquee><h2> dsssssd </h2></marquee>

Thanks to the person that did this on the https://todo-aerogear.rhcloud.com/, for providing this example.