Xss issue

[dineshrb]

Script gets executed when given as an option
$('#sampleauto').typeahead({
name: 'accounts',
local: ['github', 'select2', 'typeahead', '<script>alert("github")</script>']
});

[jharding]

Doesn't seem like the onus to prevent this scenario should belong to typeahead.js. If you plan on using typeahead.js with untrusted data, you'll need to escape it beforehand.

[dineshrb]

A hook for escaping the data should be provided atleast.

[jharding]

v0.9 will have support filters for remote and prefetched data. You'll be able to use that as your hook.

[jharding]

Closing as #25 will resolve it.