Rich authoring without arbitrary code execution
- problem
- Evaluating user-authored JSX would make a convenient editor part of the application trust boundary.
- response
- I parse a controlled source format and permit only documented media and callout components alongside Markdown, GFM, math, and code.
Result: Authors keep expressive documents without turning publication content into executable server code.
