For general comments, the script tags are properly escaped, so that it's just interpreted as text instead of as actual code. In this case, that sort of thing is handled via something known as HTML encoding, where your
<script> tag would get turned into
<script> and rendered as a text string instead of interpreted as code.
Some of the security points from the article I want to highlight:
Are Stack Snippets Safe?
Yes, as much as the web in general is safe. You are not in any more danger than you are when browsing any
client code in your browser, and you should always exercise caution
when running code contributed by another user. We isolate snippets
from our sites to block access to your private Stack Exchange data:
•We use HTML5 sandboxed iframes in order to prevent many forms of
•We render the Snippets on an external domain
(stacksnippets.net) in order to ensure that the same-origin policy is
not in effect and to keep the snippets from accessing your logged-in
session or cookies.
Like all other aspects of our site, Stack
Snippets are ultimately governed by the community. Because users can
still write code that creates annoying behaviors like infinite loops
or pop-ups, we disable snippets on any post that is heavily downvoted
(scoring less than -3 on Stack Overflow, -8 on Meta). If you see bad
code that you think should be disabled, downvote the post. If you see
code that is intended to be harmful (such as an attempt at phishing),
you should flag it for moderator attention.