Review comments.

docs/Setup.md

@@ -80,8 +80,11 @@ Theme , the CSS style sheet
 
 -   **strict**: (**default**) tags in text are encoded, click functionality is disabled
 -   **loose**: tags in text are allowed, click functionality is enabled
--   **antiscript**: html tags in text are allowed, (only script element is removed), click functionality is enabled
+-   **antiscript**: html tags in text are allowed, (only script element is removed), click
--   **sandbox**: With this security level all rendering takes place in a sandboxed iframe. This prevent any JavaScript running in the context. This may hinder interactive functionality of the diagram like scripts, popups in sequence diagram or links to other tabs/targets etc.
+    functionality is enabled
+-   **sandbox**: With this security level all rendering takes place in a sandboxed iframe. This
+    prevent any JavaScript from running in the context. This may hinder interactive functionality
+    of the diagram like scripts, popups in sequence diagram or links to other tabs/targets etc.
 
 ## startOnLoad
 
@@ -1471,6 +1474,21 @@ Returns **any** The currentConfig merged with the sanitized conf
 
 Returns **any** The currentConfig
 
+## sanitize
+
+## sanitize
+
+| Function | Description                            | Type        | Values |
+| -------- | -------------------------------------- | ----------- | ------ |
+| sanitize | Sets the siteConfig to desired values. | Put Request | None   |
+
+Ensures options parameter does not attempt to override siteConfig secure keys **Notes**: modifies
+options in-place
+
+### Parameters
+
+-   `options` **any** The potential setConfig parameter
+
 ## render
 
 Function that renders an svg with a graph from a chart definition. Usage example below.
@@ -1494,26 +1512,11 @@ $(function () {
 -   `_txt` **any** The graph definition
 -   `cb` **any** Callback which is called after rendering is finished with the svg code as inparam.
 -   `container` **any** Selector to element in which a div with the graph temporarily will be
-    inserted. In one is provided a hidden div will be inserted in the body of the page instead. The
+      inserted. If one is provided a hidden div will be inserted in the body of the page instead. The
       element will be removed when rendering is completed.
 
 Returns **any** 
 
-## sanitize
-
-## sanitize
-
-| Function | Description                            | Type        | Values |
-| -------- | -------------------------------------- | ----------- | ------ |
-| sanitize | Sets the siteConfig to desired values. | Put Request | None   |
-
-Ensures options parameter does not attempt to override siteConfig secure keys **Notes**: modifies
-options in-place
-
-### Parameters
-
--   `options` **any** The potential setConfig parameter
-
 ## addDirective
 
 Pushes in a directive to the configuration
@@ -1615,7 +1618,11 @@ Pushes in a directive to the configuration
 ```
 
 [1]: https://github.com/mermaid-js/mermaid/blob/develop/src/mermaidAPI.js
+
 [2]: Setup.md?id=render
+
 [3]: 8.6.0_docs.md
+
 [4]: #mermaidapi-configuration-defaults
+
 [5]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object

src/defaultConfig.js

@@ -65,8 +65,8 @@ const config = {
 
   /**
    * | Parameter     | Description                       | Type   | Required | Values                                     |
-   * | ------------- | --------------------------------- | ------ | -------- | ------------------------------- |
+   * | ------------- | --------------------------------- | ------ | -------- | ------------------------------------------ |
-   * | securitylevel | Level of trust for parsed diagram | string | Required | 'strict', 'loose', 'antiscript' |
+   * | securityLevel | Level of trust for parsed diagram | string | Required | 'sandbox', 'strict', 'loose', 'antiscript' |
    *
    * **Notes**:
    *
@@ -74,6 +74,9 @@ const config = {
    * - **loose**: tags in text are allowed, click functionality is enabled
    * - **antiscript**: html tags in text are allowed, (only script element is removed), click
    *   functionality is enabled
+   * - **sandbox**: With this security level all rendering takes place in a sandboxed iframe. This
+   *   prevent any JavaScript from running in the context. This may hinder interactive functionality
+   *   of the diagram like scripts, popups in sequence diagram or links to other tabs/targets etc.
    */
   securityLevel: 'strict',
 

src/mermaidAPI.js

@@ -141,7 +141,7 @@ export const decodeEntities = function (text) {
  * @param {any} _txt The graph definition
  * @param {any} cb Callback which is called after rendering is finished with the svg code as inparam.
  * @param {any} container Selector to element in which a div with the graph temporarily will be
- *   inserted. In one is provided a hidden div will be inserted in the body of the page instead. The
+ *   inserted. If one is provided a hidden div will be inserted in the body of the page instead. The
  *   element will be removed when rendering is completed.
  * @returns {any}
  */