// iframe tags should be removed
        assertFalse(result.contains("<iframe"));
        assertFalse(result.contains("</iframe>"));
    }

    @Test
    public void test_render_xss_styleTag() {
        String malicious = "<style>body { background: url('javascript:alert(1)'); }</style>";
        String result = markdownRenderer.render(malicious);
        // style tags should be removed