plantuml-markdown always enabled with no opt-out — data leakage risk via default public server #354

Problem

plantuml-markdown is unconditionally added as a markdown extension in techdocs_core/core.py:

config["markdown_extensions"].append("plantuml_markdown")

The plantuml-markdown extension defaults to http://www.plantuml.com/plantuml as its rendering server. Users who are unaware of this will have their diagram source (which may contain proprietary system architecture, IP, or internal details) sent to the public PlantUML server with no opt-out path.

Analysis

• The extension is loaded at line 194 of techdocs_core/core.py
• There is no plugin config option to disable or redirect it
• The mkdocs-techdocs-core README / docs do not mention this behavior
• markdown-graphviz-inline has the same issue — it renders inline, but graphviz is typically local

Suggested solution

1. Add a config option (e.g. plantuml_server defaulting to "") that controls whether the extension is loaded at all. When empty, skip adding plantuml_markdown.
2. Document the default behavior prominently in the README so adopters can make an informed choice.
3. Optionally add a graphviz_enabled flag for parity.

Would be happy to open a PR with the implementation if this direction is agreed.