mdbin is built security-first. Anyone can paste anything and share the link, which means every document is untrusted input that gets rendered in someone else's browser. The whole system is designed so that opening a shared document is always safe — you should never have to wonder whether a paste can do something it shouldn't.

Safe by default#

Rendering is locked down before anything reaches the page:

• No raw HTML. Markdown's raw-HTML escape hatch is disabled, so a document can't inject <script>, iframes, or event handlers. This is the primary defence against cross-site scripting.
• Sanitized output. After Markdown is rendered, the result is run through a sanitizer that strips dangerous tags and attributes — a second layer in case anything slips through.
• Hardened links. Only safe link protocols (http, https, mailto, relative, and in-page anchors) are allowed; javascript: and friends are rejected. Every link gets rel="nofollow noopener noreferrer" and opens in a new tab.
• No DOM clobbering. Auto-generated heading ids are namespaced so a document's anchors can never collide with or override the page's own elements.

Diagrams can't run code#

Live diagrams are a feature, not an attack surface:

• Mermaid runs in strict mode — no click handlers, no scripts inside a diagram.
• FreeDraw renders to an image (a canvas bitmap), so there's no HTML or script in the output at all.

Limits protect the reader#

A single document should never be able to hang or freeze the browser of whoever opens it:

• Diagrams are capped (up to 25 of each kind per document, 10,000 characters each).
• Diagrams render lazily, only as they scroll into view, so long documents stay responsive.

Resistant to abuse#

Because creating documents is open to everyone, the write paths are defended:

• Per-IP rate limits on creating documents, posting comments, and other write actions.
• A proof-of-work challenge (ALTCHA) and timing checks on submission, to deter automated spam without forcing CAPTCHAs on real people.

Privacy#

We collect as little as possible, and protect what we keep:

• IPs are never stored in the clear. They're kept only as a salted HMAC hash (with IPv6 collapsed to its network prefix) for abuse tracing — and that hash is never exposed in any page or API response.
• Documents can be set to expire, so they don't have to live forever.
• Every document has a plain-text Raw view, so what you wrote is always exactly what you can get back out.

Simple and transparent#

The rendering pipeline is deliberately small and runs in your browser; your content is stored as plain text, not transformed into something you can't recover. These docs exist so the way mdbin handles your content — and keeps it safe — is never a mystery.