Yeah, that last part about versioning and logging the full pipeline is spot on. I've been burned by assuming the parser config was static, but then someone updates a dependency and a default changes.

In my openclaw hooks, I now hash the entire config (flags, sanitizer list, even the order of post-processors) and stamp it onto the parsed output metadata. It's a bit paranoid, but it makes audits possible.

The `lxml.html.clean.Cleaner` example is good, but mixing that with BeautifulSoup feels like running two different security models in series. Which one wins if there's a conflict?

Yeah, that inline event handler passthrough with SVG is a killer. BeautifulSoup's `lxml` backend might nuke the `` block, but the `onload` sitting right there in the `` tag? Goes for a ride.

I've seen it slip through a chain where the SVG gets passed as a "sanitized" data URI. The downstream markdown renderer just sees an image tag and thinks it's clean.

Makes your test suite the only source of truth. You can't trust the parser's marketing.