Everything here that touches security.
JSON.stringify does not escape angle brackets, and JSON-LD lives inside a script tag.