# Security

> Content is untrusted.

- Raw HTML is text.
- Only Markdown's own elements and registered blocks render. App-wide components can't be reached from Markdown.
- `script`, `style`, `iframe`, `object` and similar are removed, with their content. So are `on*` handlers, `style` attributes (except a highlighter's colours inside code) and URLs that aren't relative, `http(s)`, `mailto` or `tel`.
- `<WriterContent>` sanitizes again before rendering, so a stored document is safe even if it didn't come from this parser.

The checks are exported from `@humanonlyweb/writer/parse`: `sanitize(nodes, isAllowed?)`, `isSafeUrl(url)` and `NATIVE_TAGS`.

## What's left to you

- Authors can set `class` and `id` with `{…}`. With untrusted authors and utility-class CSS (`fixed inset-0`), that's enough to restyle the page: strip them from parsed documents, or render those elements through `components`.
- Blocks get attributes as written. Validate any URL your block puts in an attribute other than `href` or `src`.
- CodeMirror injects `<style>` elements. Under a strict CSP, pass `EditorView.cspNonce.of(nonce)` in `extensions`.