I'd be happy to take a patch for this, actually. Something to focus on would be making sure malicious users can't inject HTML into cgit through it somehow.