@zekjur i wonder if this works when the diff is hidden within a markdown comment <!— like this —>

That could be an extremely bad vulnerability