Users can un-ban some terms pretty easily.

var escape = (function(){return this;})();
try{
escape.BabyHint.bannedProperties = [];
}catch(e){}
Unbans terms like document and such. Also, escape grants access to eval and some other great stuff.

Start by reproducing the reported snippet in the live coding environment and tracing how BabyHint.bannedProperties is exposed. Verify that user code can no longer clear the banned terms or obtain access to eval, and add or update coverage for both bypasses if the repository provides a relevant test entry point.

Written by the indexing model from the issue text.