Markdown notes are persisted in data/notes.json and rendered with a script-tag blacklist.
data/notes.json
Save a note with /note?body=..., then view /notes.
/note?body=...
/notes