diff --git a/tests/lib/markdown.test.ts b/tests/lib/markdown.test.ts
index 184e1ed..4292866 100644
--- a/tests/lib/markdown.test.ts
+++ b/tests/lib/markdown.test.ts
@@ -394,6 +394,57 @@ describe("comments", () => {
 	});
 });
 
+describe("security", () => {
+	test("callout type rejects non-word characters", () => {
+		const { html } = renderMarkdown("> [!no<script>te]\n> test");
+		expect(html).toContain("<blockquote>");
+		expect(html).not.toContain("callout");
+		expect(html).not.toContain("<script>");
+	});
+
+	test("callout custom title does not inject attributes", () => {
+		const { html } = renderMarkdown('> [!NOTE]" onclick="alert(1)\n> test');
+		expect(html).not.toMatch(/<[a-z]+\s[^>]*onclick\s*=/i);
+	});
+
+	test("comment strips hidden markup completely", () => {
+		const { html } = renderMarkdown("Before %%**bold** and [[link]]%% after");
+		expect(html).toContain("Before");
+		expect(html).toContain("after");
+		expect(html).not.toContain("bold");
+		expect(html).not.toContain("link");
+		expect(html).not.toContain("<strong>");
+		expect(html).not.toContain("wikilink");
+	});
+});
+
+describe("cross-feature interactions", () => {
+	test("highlight inside callout", () => {
+		const { html } = renderMarkdown(
+			"> [!NOTE]\n> This is ==highlighted== inside.",
+		);
+		expect(html).toContain("callout-note");
+		expect(html).toContain("<mark>");
+		expect(html).toContain("highlighted");
+	});
+
+	test("task list inside callout", () => {
+		const { html } = renderMarkdown("> [!TODO]\n> - [ ] Do this\n> - [x] Done");
+		expect(html).toContain("callout-todo");
+		expect(html).toContain('type="checkbox"');
+		expect(html).toContain("checked");
+	});
+
+	test("footnote ref inside callout, definition outside", () => {
+		const { html } = renderMarkdown(
+			"> [!TIP]\n> See this[^1]\n\n[^1]: Footnote text.",
+		);
+		expect(html).toContain("callout-tip");
+		expect(html).toContain('class="footnote-ref"');
+		expect(html).toContain("Footnote text");
+	});
+});
+
 describe("heading anchors", () => {
 	test("attaches id to rendered headings", () => {
 		const { html } = renderMarkdown("# Hello World\n\n## Another One");