# Security review asks where document content and diagram source go

**What you are seeing**

Security review asks where document content and diagram source go.

---

## Why it happens

All external addresses are declared as not in scope for end-user data.

---

## What to do

There is currently no self-hosted renderer option and no way to keep diagram source inside your own network.

---

## Settings involved

| **Setting**                 | **Where**                                                | **What it does** |
| --------------------------- | -------------------------------------------------------- | ---------------- |
| Sort tabs                   | Issue view > Markdown panel > sort button                | \-               |
| Getting started / List view | Apps > Capable Markdown > two icon buttons in the header | \-               |
| Project filter              | Apps > Capable Markdown > project selector               | \-               |

---

## Limits that apply here

| **Limit**              | **Value**                  | **What happens**                                                                                                                                               |
| ---------------------- | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Large document preview | About 1,000,000 characters | Read-only previews longer than this switch to a virtualised viewer that renders in chunks as you scroll, so browser find-in-page and similar behaviour differ. |

---

## A few things that catch people out

* Non-production builds (staging, PR previews, local tunnels) run with licensing disabled, which bypasses the licence check and also drops the licensed attachment triggers unless a licence is forced.

---

## Related

[Capable Markdown global page shows no results, even though issues do have .md attachmentsThe page is driven by a search index that is only written when the app is licensed. The at](https://help.gocapable.com/jira-markdown/capable-markdown-global-page-shows-no-results-even-though-issues-do-have-md-attachments.html)

[Markdown files that were on issues before the app was installed never show on the global pageThere is no backfill and no scheduled reindex. The index is written only when an attachmen](https://help.gocapable.com/jira-markdown/markdown-files-that-were-on-issues-before-the-app-was-installed-never-show-on-the-global-page.html)

[Everything elseThe rest of this family.](https://help.gocapable.com/jira-markdown/everything-else.html)

---

_Found it? Good._