Markdown can contain raw HTML, links and image syntax. A private preview must define each boundary instead of treating every parser output as trusted.
Raw HTML becomes visible text
Tags are escaped and wrapped as code, so scripts and event handlers are not inserted as elements.
Image syntax makes no request
The alt text remains readable while the remote URL is never assigned to an image element.
Sanitization remains a final boundary
Angular sanitizes the rendered string normally; no security-bypass API is used.