Also, this will execute any JS in the generated markdown. Does the markdown do any stripping to remove `<script>` elements or other potential self-XSS stuff?