My guess is that it has something to do with the fact that Github is made up almost entirely of user generated content. Just load a Github project page. From to

My guess is that it has something to do with the fact that Github is made up almost entirely of user generated content. Just load a Github project page. From top to bottom, you have: * Username in the header (which is probably validated with a specific format, so probably doesn't need escaping). * Project summary entered when the project is created. * Drop-down with list of branch and tag names. * Latest commit message. * List of names for all folders and files tracked in git for the project. * Readme text. That's just the homepage for a project, and each one of those things could potentially contain malicious HTML or JS, meaning it should be escaped before rendered on the page.