- RBAC should be enforced on service logic. - We should not check for referenced records existence from db due to the nature of atproto. - Comment depth validation is not necessary. We can accept them and just don't render replies with deeper depth. Move markdown sanitizer to dedicated package to avoid import cycle Signed-off-by: Seongmin Lee <git@boltless.me>