Trigger 
Describe Security
Safe to open. Safe to serve on.
A PDF is an untrusted document. Conversion is designed so the resulting HTML is safe to open in a browser and safe to serve to third parties.
Output safety
Four guarantees every conversion makes.
Text stays text
Text is always emitted as live, positioned HTML — never a screenshot, even when a page's graphics are rasterized for correct compositing.
Everything HTML-encoded
Every dynamic string pulled from the PDF — run text, titles, bookmark labels, link labels and targets — is HTML-encoded before it reaches the output.
Link allow-list
Link targets are filtered to http(s)/mailto/tel at extraction time;
javascript:, data: and file: targets are
dropped, and survivors carry rel="noopener noreferrer".
No outbound references
Self-contained output inlines fonts, images and SVG as data: URIs,
so a strict Content-Security-Policy is straightforward to apply.
Resource budgets
Conversion is CPU-bound — a hostile PDF is a DoS surface.
Every conversion path runs against hard bounds, so a malicious document cannot turn a deployment into an unbounded workload.
Plus a render DPI clamp (18–600) and, on the web service, an upload cap (1 GB), a request rate limit, a live-job cap and job expiry.
Full detail, including which guarantees have an end-to-end test and which are documented gaps, is in the security documentation.