As to the security concerns, I strongly recommend passing the results of Markdown compilation into a separate HTML sanitizer library. Preferably one based on wh

As to the security concerns, I strongly recommend passing the results of Markdown compilation into a separate HTML sanitizer library. Preferably one based on whitelisting. You should do this even if your Markdown compiler claims to protect against malicious HTML. The way I see it, a dedicated HTML sanitizer library is less likely to let something through than a Markdown compiler that offers sanitization as an afterthought. For Ruby, I like Sanitize (https://github.com/rgrove/sanitize https://github.com/rgrove/sanitize). I'm sure you can find something similar for any major language.