---

steveklabnik · steveklabnik · commit f93df943df82 · 2015-04-16T23:50:12.000-04:00
yaml --- r: 209509 b: refs/heads/try c: 3ca83a7 h: refs/heads/master i: 209507: e3678ea v: v3
diff --git a/[refs] b/[refs]
@@ -2,7 +2,7 @@
 refs/heads/master: 3e561f05c00cd180ec02db4ccab2840a4aba93d2
 refs/heads/snap-stage1: e33de59e47c5076a89eadeb38f4934f58a3618a6
 refs/heads/snap-stage3: ba0e1cd8147d452c356aacb29fb87568ca26f111
-refs/heads/try: 00a8d65ef3389164f1c71ec95f686530fdfc9d9d
+refs/heads/try: 3ca83a79bf6fcd019ab53e1b10a83663c6b3a34d
 refs/tags/release-0.1: 1f5c5126e96c79d22cb7862f75304136e204f105
 refs/heads/dist-snap: ba4081a5a8573875fed17545846f6f6902c8ba8d
 refs/tags/release-0.2: c870d2dffb391e14efb05aa27898f1f6333a9596
diff --git a/branches/try/src/doc/trpl/documentation.md b/branches/try/src/doc/trpl/documentation.md
@@ -560,3 +560,13 @@ This sets a few different options, with a logo, favicon, and a root URL.
 - `--html-before-content FILE`: includes the contents of FILE directly after
   `<body>`, before the rendered content (including the search bar).
 - `--html-after-content FILE`: includes the contents of FILE after all the rendered content.
+
+## Security note
+
+The Markdown in documentation comments is placed without processing into
+the final webpage. Be careful with literal HTML:
+
+```rust
+/// <script>alert(document.cookie)</script>
+# fn foo() {}
+```
