@@ -215,6 +215,15 @@ on nodes:
215215* `node.data.id` — Used, in the future, by other tools to signal
216216 unique identifiers on nodes
217217
218+## Security
219+
220+`remark-validate-links`, in Node, accesses the file system based on user
221+content, and this may be dangerous.
222+In Node `git remote` and `git rev-parse` also runs for processed files.
223+
224+The tree is not modified, so there are no openings for
225+[cross-site scripting (XSS)][xss] attacks.
226+
218227## Related
219228
220229* [`remark-lint`][remark-lint] — Markdown code style linter
@@ -289,3 +298,5 @@ abide by its terms.
289298[package-repository]: https://docs.npmjs.com/files/package.json#repository
290299
291300[cwd]: https://github.com/vfile/vfile#vfilecwd
301+
302+[xss]: https://en.wikipedia.org/wiki/Cross-site_scripting