How is the HTML preview implemented regarding security?

[somas95]

Hi, I'm the maintainer of a different md editor (very different in scope though), and dealing with secure HTML rendering I stumbled upon your project and got curious on how this issue is tackled in ghostwriter. AFAIK the default renderer (cmark-gfm) handles this very nicely, but even when selecting other renderers such as pandoc the preview ignores things such as javascript scripts. I couldn't find in the source where the produced HTML is sanitized, so I'm honestly curious on what was your approach. Thanks for the insights