Power BI cross site scripting mitigation

We need confidence that the web browser for the PBI gateway is protected from cross site scripting threat – that the browser code ( javascript/html ) is output encoded so that any bad data masking as code that may possibly be retrieved from a data source would not be able to impact the PBI gateway browser ?