Copilot review overview

The sanitizer still has source-corruption and URL-masking edge cases that weaken its fidelity and security guarantees.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 4

New issues introduced by this change (4)

Severity	Finding
	`pkg/sanitize/sanitize.go` — This fallback escapes every ampersand, including those inside inline, fenced, and indented code.…
	`pkg/sanitize/sanitize.go` — The bare-URL detector treats every alphabetic `scheme://` token as safely visible, although the…
	`pkg/sanitize/sanitize.go` — These loops cast individual UTF-8 bytes to runes, so Unicode whitespace is never recognized. With…
	`pkg/sanitize/sanitize.go` — This lookup is case-sensitive even though URI schemes are case-insensitive. A valid CommonMark…

What changed in this PR

Introduces Markdown-aware sanitization to preserve code-bearing GitHub content while neutralizing hidden constructs.

Changes:

File	Description
`pkg/sanitize/sanitize.go`	Implements Markdown-aware sanitization.
`pkg/sanitize/sanitize_test.go`	Tests fidelity, safety, and performance.
`pkg/github/minimal_types.go`	Applies content sanitization to converters.
`pkg/github/issues.go`	Sanitizes issue and sub-issue responses.
`pkg/github/issues_test.go`	Tests sub-issue sanitization.
`pkg/github/repositories.go`	Sanitizes releases and blame messages.
`pkg/github/repositories_test.go`	Tests release and blame behavior.
`pkg/github/discussions.go`	Preserves discussion body content.
`pkg/github/discussions_test.go`	Updates discussion expectations.
`pkg/github/projects.go`	Uses content policy for status updates.
`pkg/github/sanitize_coverage_test.go`	Expands policy coverage tests.
`go.mod`	Adds Goldmark dependency.
`go.sum`	Records Goldmark checksums.
`third-party/github.com/yuin/goldmark/LICENSE`	Adds Goldmark’s license.
`third-party-licenses.linux.md`	Updates Linux licenses.
`third-party-licenses.darwin.md`	Updates macOS licenses.
`third-party-licenses.windows.md`	Updates Windows licenses.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.