Do you have any kind of Web Application Firewall in front of Discourse (eg. CloudFlare or AWS WAF)? It might be detecting it as a Cross-Site Scripting attack.
Do you have any kind of Web Application Firewall in front of Discourse (eg. CloudFlare or AWS WAF)? It might be detecting it as a Cross-Site Scripting attack.