Markdown sanitizer misses reference-style link injection

[atararushi001]

Hi, I found a minor security issue in the contact form's markdown sanitization that I would like to report responsibly rather than describe here, since this repo doesn't have GitHub's private vulnerability reporting enabled and there's no SECURITY.md.

Could you either enable Private vulnerability reporting under Settings, Security, Code security, or share a contact such as an email I could use instead?

Happy to share full details as soon as there's a private channel. Thanks for maintaining this project!