01
Rendering
User Markdown becomes sanitized semantic HTML. Scripts, event handlers, forms, iframes, unsafe URLs, arbitrary CSS, and user-authored MDX do not execute.
Security
Untrusted documents stay untrusted.
MDLoom treats Markdown, HTML, archives, images, and diagrams as hostile until each layer has validated and constrained them.
Browser-only release
Content does not become trusted because it has a Markdown extension.
Preview sanitizes generated HTML. Your source never needs to leave this browser for writing, merge, or print.
Control surface
Security follows the file through this browser
A safe preview is the main boundary. There is no conversion kitchen or user table in this release.
02
This browser only
Drafts, merge work, and preferences stay in IndexedDB and localStorage on this device. Clearing site data removes them.
03
No user locker
MDLoom does not create accounts and does not store visitor Markdown on a server.
04
Print uses the same sanitized preview as the editor. The browser print dialog stays on the visitor’s machine.
05
Secrets
The website only needs a public site URL and an optional support email. There is no database key and no service-role secret.
06
Downloads
Markdown, HTML, and ZIP downloads are generated in this browser. MDLoom does not keep a copy after you save the file.
Report a concern
Security contact status
A public deployment needs a verified, monitored private channel for vulnerability reports.
Email naseebsingh3510@gmail.com with “Security report” in the subject. Do not include real user documents.
A helpful report includes
- • Affected route or component
- • Minimal reproduction steps
- • Expected and observed impact
- • Safe proof using your own data
- • Relevant browser or client version
- • A secure way to follow up