Make CommonMark safe by default?

@xenoterracide safety is not spec issue, that’s managed on implementation level. For example, markdown-it is safe by default.