The formatting kitchen sink: every block this blog can render

This post exists as a living reference. Everything below is something you can drop into a real article — copy the raw .mdx and delete what you don’t need. If it renders correctly here, it will render correctly anywhere. 🚀

Text and inline styles

Paragraphs support bold text, italic text, bold italic, strikethrough, and inline code. You can link to another page on this site or to an external resource — external links automatically open in a new tab and get safe rel attributes.

Footnotes work too: here’s a claim that needs a source.¹

Heading level three

Use these to break a long article into scannable sections.

Heading level four

Good for sub-points inside a section.

Heading level five (styled as an eyebrow label)

Heading level six

Lists

An unordered list, with nesting:

• Threat modeling before the first commit
• Least-privilege access by default
  • Scoped to the service
  • Scoped to the environment
  • Expiring on a short clock
• Observability you can actually query

An ordered list:

1. Identify what you’re protecting
2. Map how an attacker reaches it
3. Close the cheapest paths first
4. Re-check after every change

A task list (GFM):

• Rotate the signing key
• Enable branch protection
• Migrate remaining static credentials
• Add reproducible builds

Blockquote

The most secure configuration is worthless if it’s the one nobody chooses. Make it the one they can’t avoid.

Table

Image

Reference an image from public/ with standard Markdown syntax:

Code blocks

A plain block with no language and no frame:

$ whoami
analyst

A block with a title, line numbers, and highlighted lines:

1
import { getSecret } from './vault-client.js'
2

3
async function initDatabase() {
4
  // These lines are highlighted
5
  const dbUrl = await getSecret('db/connection-string')
6
  return connect(dbUrl)
7
}

A terminal frame (any shell language with a title renders as a terminal):

# Mint a short-lived token instead of using a static key
vault token create -ttl=15m -policy=deploy

Inserted and removed lines (diff-style markers):

function connect(url) {
  const key = process.env.STATIC_API_KEY
  const key = await getSecret('api/key') // rotates automatically
  return new Client({ url, key })
}

A collapsible section — lines fold away until the reader expands them:

export default {
5 collapsed lines
  // ...boilerplate the reader can skip...
  runtime: 'node20',
  memory: 512,
  timeout: 30,
  region: 'iad1',
  permissions: 'least-privilege', // the line that actually matters
}

Long lines wrap by default, so nothing overflows the page horizontally even when a command or string runs well past the width of the container and just keeps going and going without a single break in sight.

Written by Gaurav Raj (@thehackersbrain) ↗