diff --git a/bun.lock b/bun.lock
index 3215ae23..ff718056 100644
--- a/bun.lock
+++ b/bun.lock
@@ -30,6 +30,7 @@
         "openapi-fetch": "^0.14.0",
         "prettier": "^3.6.2",
         "prettier-plugin-svelte": "^3.4.0",
+        "sanitize-markdown": "^2.6.7",
         "svelte": "^5.39.4",
         "svelte-adapter-bun-next": "^1.0.3",
         "svelte-check": "^4.3.1",
@@ -313,6 +314,8 @@
 
     "aria-query": ["aria-query@5.3.2", "", {}, "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw=="],
 
+    "assignment": ["assignment@2.0.0", "", {}, "sha512-naMULXjtgCs9SVUEtyvJNt68aF18em7/W+dhbR59kbz9cXWPEvUkCun2tqlgqRPSqZaKPpqLc5ZnwL8jVmJRvw=="],
+
     "asynckit": ["asynckit@0.4.0", "", {}, "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="],
 
     "axobject-query": ["axobject-query@4.1.0", "", {}, "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="],
@@ -655,6 +658,8 @@
 
     "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],
 
+    "sanitize-markdown": ["sanitize-markdown@2.6.7", "", { "dependencies": { "assignment": "2.0.0" } }, "sha512-w0exIpQ6Zk/q4yUZNgYcxz5sO1o+y3zYeJlHXp+AGKUPOy9wUoKUpu6/+qVlW6oGMvQ72N/6Gx8q/tZG/CKxSA=="],
+
     "saxes": ["saxes@6.0.0", "", { "dependencies": { "xmlchars": "^2.2.0" } }, "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA=="],
 
     "semver": ["semver@7.7.2", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA=="],
diff --git a/package.json b/package.json
index cabbd7ce..c9708473 100644
--- a/package.json
+++ b/package.json
@@ -29,6 +29,7 @@
     "openapi-fetch": "^0.14.0",
     "prettier": "^3.6.2",
     "prettier-plugin-svelte": "^3.4.0",
+    "sanitize-markdown": "^2.6.7",
     "svelte": "^5.39.4",
     "svelte-adapter-bun-next": "^1.0.3",
     "svelte-check": "^4.3.1",
diff --git a/src/lib/api/base.ts b/src/lib/api/base.ts
index a962affa..38b64efd 100644
--- a/src/lib/api/base.ts
+++ b/src/lib/api/base.ts
@@ -27,7 +27,7 @@ export abstract class BaseClient {
   }
 
   static async fetchInfo(
-    base: string,
+    base: string | URL,
   ): Promise<{ type: ClientType; version: string } | null> {
     try {
       const res = await fetch(new URL('/nodeinfo/2.1', base))
diff --git a/src/lib/app/markdown/Markdown.svelte b/src/lib/app/markdown/Markdown.svelte
index 739806af..0b6e70f0 100644
--- a/src/lib/app/markdown/Markdown.svelte
+++ b/src/lib/app/markdown/Markdown.svelte
@@ -29,8 +29,14 @@
   import MdTableHead from './renderers/table/MdTableHead.svelte'
   import MdTableRow from './renderers/table/MdTableRow.svelte'
 
+  function preprocess(src: string) {
+    return src
+      .replaceAll(/\[([^\]]*)\]\(\s*javascript:[^)]*\)/gim, '*link removed*')
+      .replaceAll(/^\s*\[[^\]]+\]:\s*javascript:.*$/gim, '*link removed*')
+  }
+
   marked.setOptions({
-    gfm: true,
+    gfm: false,
     breaks: false,
   })
 
@@ -141,7 +147,7 @@
     noStyle: noStyle,
   })
 
-  let tokens = $derived(marked.lexer(source))
+  let tokens = $derived(marked.lexer(preprocess(source)))
 </script>
 
 <svelte:element
diff --git a/src/lib/app/markdown/MdTree.svelte b/src/lib/app/markdown/MdTree.svelte
index bdaf1bd5..0d670df5 100644
--- a/src/lib/app/markdown/MdTree.svelte
+++ b/src/lib/app/markdown/MdTree.svelte
@@ -23,15 +23,6 @@
     ...rest
   }: Props = $props()
 
-  function decodeHtmlEntities(input: string) {
-    return input
-      .replace(/&#39;/g, "'")
-      .replace(/&quot;/g, '"')
-      .replace(/&lt;/g, '<')
-      .replace(/&gt;/g, '>')
-      .replace(/&amp;/g, '&')
-  }
-
   if (header) {
     type = 'tablecell'
   }
@@ -50,7 +41,7 @@
               {...rest}
             />
           {:else if token.text}
-            {decodeHtmlEntities(token.text)}
+            {token.text}
           {:else if text}
             {text}
           {/if}
diff --git a/src/routes/login/+page.svelte b/src/routes/login/+page.svelte
index bceb913a..d4d75936 100644
--- a/src/routes/login/+page.svelte
+++ b/src/routes/login/+page.svelte
@@ -60,7 +60,9 @@
   })
 
   async function checkInstance() {
-    const type = await BaseClient.fetchInfo(instanceToURL(form.instance))
+    const type = await BaseClient.fetchInfo(
+      new URL(instanceToURL(form.instance)),
+    )
     if (type == null) throw Error('not_live_supported')
     form.client = type?.type
   }
diff --git a/src/routes/login/guest/+page.svelte b/src/routes/login/guest/+page.svelte
index 06ecb364..88c9c7bb 100644
--- a/src/routes/login/guest/+page.svelte
+++ b/src/routes/login/guest/+page.svelte
@@ -39,7 +39,9 @@
   })
 
   async function checkInstance() {
-    const type = await BaseClient.fetchInfo(instanceToURL(form.instance))
+    const type = await BaseClient.fetchInfo(
+      new URL(instanceToURL(form.instance)),
+    )
     if (type == null) throw Error('not_live_supported')
     form.client = type?.type
   }