Yes — and this genuinely matters, because Markdown allows raw HTML, so an input containing <img src=x onerror=…> would otherwise be a live XSS vector. The rendered output is passed through DOMPurify before display, which strips scripts, event handlers and dangerous attributes. Sanitising the parsed DOM rather than escaping the input text is what makes it resistant to mutation-XSS tricks.
Why does a single newline not create a line break?
Because CommonMark treats consecutive lines as one paragraph — that is the specification. GitHub comments deviate from this and break on every newline, which is why the "breaks" option exists. Turn it on to match GitHub, leave it off to match the spec and most static site generators.
Which Markdown flavour is supported?
CommonMark plus GitHub Flavored Markdown extensions: tables, task lists, strikethrough and autolinks. Platform-specific syntax such as Obsidian wiki-links or MDX components is not rendered.