diff --git a/appview/pages/funcmap.go b/appview/pages/funcmap.go
index 816b083..038e745 100644
--- a/appview/pages/funcmap.go
+++ b/appview/pages/funcmap.go
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/dustin/go-humanize"
+	"github.com/microcosm-cc/bluemonday"
 	"tangled.sh/tangled.sh/core/appview/filetree"
 	"tangled.sh/tangled.sh/core/appview/pages/markup"
 )
@@ -144,7 +145,7 @@ func funcMap() template.FuncMap {
 		},
 		"markdown": func(text string) template.HTML {
 			rctx := &markup.RenderContext{RendererType: markup.RendererTypeDefault}
-			return template.HTML(rctx.RenderMarkdown(text))
+			return template.HTML(bluemonday.UGCPolicy().Sanitize(rctx.RenderMarkdown(text)))
 		},
 		"isNil": func(t any) bool {
 			// returns false for other "zero" values
diff --git a/appview/pages/markup/markdown.go b/appview/pages/markup/markdown.go
index f684c0b..e41c003 100644
--- a/appview/pages/markup/markdown.go
+++ b/appview/pages/markup/markdown.go
@@ -10,6 +10,7 @@ import (
 	"github.com/yuin/goldmark/ast"
 	"github.com/yuin/goldmark/extension"
 	"github.com/yuin/goldmark/parser"
+	"github.com/yuin/goldmark/renderer/html"
 	"github.com/yuin/goldmark/text"
 	"github.com/yuin/goldmark/util"
 	"tangled.sh/tangled.sh/core/appview/pages/repoinfo"
@@ -41,6 +42,7 @@ func (rctx *RenderContext) RenderMarkdown(source string) string {
 		goldmark.WithParserOptions(
 			parser.WithAutoHeadingID(),
 		),
+		goldmark.WithRendererOptions(html.WithUnsafe()),
 	)
 
 	if rctx != nil {
diff --git a/appview/pages/pages.go b/appview/pages/pages.go
index 6b59034..ae18d02 100644
--- a/appview/pages/pages.go
+++ b/appview/pages/pages.go
@@ -562,7 +562,7 @@ func (p *Pages) RepoBlob(w io.Writer, params RepoBlobParams) error {
 		case markup.FormatMarkdown:
 			p.rctx.RepoInfo = params.RepoInfo
 			p.rctx.RendererType = markup.RendererTypeRepoMarkdown
-			params.RenderedContents = template.HTML(p.rctx.RenderMarkdown(params.Contents))
+			params.RenderedContents = template.HTML(bluemonday.UGCPolicy().Sanitize(p.rctx.RenderMarkdown(params.Contents)))
 		}
 	}