From 36979b3e90e520f2aac6890ca04dce3e17529793 Mon Sep 17 00:00:00 2001
From: Colin O'Dell <colinodell@gmail.com>
Date: Sat, 14 Sep 2024 06:37:40 -0400
Subject: [PATCH] Add explicit suggestion to configure security-related options

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index d815c58..c2cce7e 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,8 @@ The included `demo` directory contains an HTML->Markdown conversion form to try
 
 ### Conversion options
 
-By default, HTML To Markdown preserves HTML tags without Markdown equivalents, like `<span>` and `<div>`.
+> [!WARNING]  
+> By default, this library preserves HTML tags without Markdown equivalents, like `<span>`, `<div>`, `<iframe>`, `<script>`, etc. If you will be parsing untrusted input from users, **please consider setting the `strip_tags` and/or `remove_nodes` options** documented below, and also using a library (like [HTML Purifier](https://github.com/ezyang/htmlpurifier)) to provide additional HTML filtering.
 
 To strip HTML tags that don't have a Markdown equivalent while preserving the content inside them, set `strip_tags` to true, like this: