Safe rendering
Notes are sanitized before they’re shown, so a note can’t run code in Papeliz.
Why it matters#
Papeliz keeps your API key in the same page that shows your notes, so a note must never be able to run code there.
What Papeliz does#
- Raw HTML in a note isn’t rendered, except one checked form for colored and resized text. See Format text.
- Every rendered note goes through a sanitizer built on GitHub’s safe list, which removes anything that could run script, such as
<script>tags,on…attributes andjavascript:links. - Web links open in a new tab, apart from Papeliz.
Notes from anywhere#
You can open a folder of notes from any source. Papeliz shows them as text and formatting only: nothing in a note runs.