# Security Guide

Best practices for secure markdown parsing.

## Critical: No HTML Sanitization

Marked does NOT sanitize HTML output. Always use a sanitization library.

```javascript { .api }
import { marked } from "marked";
import DOMPurify from "dompurify";

// UNSAFE
const unsafeHtml = marked.parse(userInput);

// SAFE
const dirty = marked.parse(userInput);
const clean = DOMPurify.sanitize(dirty);
```

## Recommended Sanitization Libraries

- [DOMPurify](https://www.npmjs.com/package/dompurify) - Most comprehensive
- [sanitize-html](https://www.npmjs.com/package/sanitize-html) - Configurable
- [js-xss](https://www.npmjs.com/package/xss) - Lightweight

## Additional Security Measures

- Validate and limit file sizes
- Implement rate limiting for user input
- Use Content Security Policy (CSP) headers
- Disable dangerous markdown features if not needed

## XSS Prevention

```javascript { .api }
import { marked } from "marked";
import DOMPurify from "dompurify";

function safeRender(markdown) {
  const html = marked.parse(markdown);
  return DOMPurify.sanitize(html, {
    ALLOWED_TAGS: ['p', 'strong', 'em', 'a', 'ul', 'ol', 'li'],
    ALLOWED_ATTR: ['href']
  });
}
```
