Why this renderer escapes HTML

Most markdown specifications, including GitHub-flavoured markdown, allow raw HTML to pass through untouched — a genuinely useful feature when you control the document. In a tool that renders whatever a visitor pastes, it is a cross-site-scripting hole with a friendly name: a document containing a script tag or an image with an onerror handler would execute in the page that rendered it. The usual remedy is to render everything and then run the result through a sanitiser, which works but depends on the sanitiser knowing every bypass. This renderer takes the stricter route of escaping every character from the source up front, so the only markup that can reach the output is markup it generated itself. The cost is that inline HTML shows as text rather than rendering; the benefit is that there is no class of pasted document that can do anything unexpected.

Markdown flavours and why output differs between tools

There is no single markdown standard. The original 2004 implementation left many cases undefined, and the gaps were filled differently by everyone who came after — which is why the same file can render three ways in three tools. CommonMark exists to pin down the ambiguous cases precisely, and GitHub-flavoured markdown builds on it with tables, task lists, strikethrough and autolinking. When a document looks right in one editor and wrong in another, the difference is almost always one of these undefined corners: how many spaces indent a nested list, whether underscores inside a word mark emphasis, or whether a line break inside a paragraph is preserved. This tool follows GitHub's conventions, which is what most people writing markdown today are actually targeting.