@@ -355,6 +355,23 @@ func Test_ReadModifyWriteBody_ReferenceDestinationAndBareURL(t *testing.T) {
 	assert.Equal(t, expected, commentBody)
 }
 
+// Test_ReadModifyWriteBody_UnbalancedReferenceDestinationAndLargeInput covers this round's fixes:
+// a reference destination with an unbalanced paren must not be masked, leaving trailing hidden
+// math exposed, and a large adversarial run of malformed inline-link candidates must still be
+// processed (bounded destination scanning) rather than degrading through the tool conversion path.
+func Test_ReadModifyWriteBody_UnbalancedReferenceDestinationAndLargeInput(t *testing.T) {
+	original := "[x]: foo($ignore$\n\n" + "$hidden$" + strings.Repeat("[y](", 500)
+	expected := "\\[x]: foo(\\$ignore\\$\n\n" + "\\$hidden\\$" + strings.Repeat("[y](", 500)
+
+	issueBody := convertToMinimalIssue(&github.Issue{Body: github.Ptr(original)}).Body
+	pullRequestBody := convertToMinimalPullRequest(&github.PullRequest{Body: github.Ptr(original)}).Body
+	commentBody := convertToMinimalIssueComment(&github.IssueComment{Body: github.Ptr(original)}).Body
+
+	assert.Equal(t, expected, issueBody)
+	assert.Equal(t, expected, pullRequestBody)
+	assert.Equal(t, expected, commentBody)
+}
+
 // Test_MinimalConverters_PreserveCodeFidelity ensures the sanitization work does not spill over
 // into fidelity-sensitive fields (diffs/patches and raw file content), which must survive byte
 // for byte so patches can still be applied and code isn't corrupted.
 
@@ -85,6 +85,13 @@ func Content(input string) string {
 
 const maxContentFilterPasses = 4
 
+// maxLinkDestinationLength bounds how far destination-scanning functions look
+// for a terminator (matching bracket, closing angle bracket) before giving
+// up. Without a bound, an unterminated destination forces a scan to the end
+// of input on every call site, which is quadratic across many such
+// candidates.
+const maxLinkDestinationLength = 4096
+
 var markdownParser = goldmark.DefaultParser()
 
 type sourceSpan struct {
@@ -548,7 +555,8 @@ func referenceLinkDestinationSpan(source []byte, start int) (sourceSpan, int, bo
 
 	parentheses := 0
 	stop := start
-	for stop < len(source) {
+	limit := min(len(source), start+maxLinkDestinationLength)
+	for stop < limit {
 		r, size := utf8.DecodeRune(source[stop:])
 		if unicode.IsSpace(r) {
 			break
@@ -563,11 +571,15 @@ func referenceLinkDestinationSpan(source []byte, start int) (sourceSpan, int, bo
 		}
 		stop += size
 	}
+	if parentheses != 0 {
+		return sourceSpan{}, start, false
+	}
 	return sourceSpan{start: start, stop: stop}, stop, true
 }
 
 func angleAutoLinkSpan(source []byte, start int) (sourceSpan, int, bool) {
-	closeOffset := bytes.IndexByte(source[start+1:], '>')
+	searchLimit := min(len(source), start+1+maxLinkDestinationLength)
+	closeOffset := bytes.IndexByte(source[start+1:searchLimit], '>')
 	if closeOffset < 0 {
 		return sourceSpan{}, start, false
 	}
@@ -600,7 +612,8 @@ func inlineDestinationSpan(source []byte, start int) (sourceSpan, int, bool) {
 	}
 
 	if source[start] == '<' {
-		for stop := start + 1; stop < len(source); stop++ {
+		limit := min(len(source), start+1+maxLinkDestinationLength)
+		for stop := start + 1; stop < limit; stop++ {
 			if source[stop] == '>' && !isBackslashEscapedBytes(source, stop) {
 				closing := stop + 1
 				for closing < len(source) && unicode.IsSpace(rune(source[closing])) {
@@ -616,7 +629,8 @@ func inlineDestinationSpan(source []byte, start int) (sourceSpan, int, bool) {
 	}
 
 	parentheses := 0
-	for stop := start; stop < len(source); {
+	limit := min(len(source), start+maxLinkDestinationLength)
+	for stop := start; stop < limit; {
 		r, size := utf8.DecodeRune(source[stop:])
 		if r == '(' || r == ')' {
 			if !isBackslashEscapedBytes(source, stop) {
 
@@ -647,6 +647,11 @@ func TestContentPreservesVisibleContent(t *testing.T) {
 			input:    "[query]\n\n[query]: /api/$filter$ $\\phantom{hidden}$",
 			expected: "[query]\n\n[query]: /api/$filter$ \\$\\phantom{hidden}\\$",
 		},
+		{
+			name:     "exposes hidden math after an unbalanced reference destination paren",
+			input:    "[x]: foo($ignore$",
+			expected: "\\[x]: foo(\\$ignore\\$",
+		},
 		{
 			name:     "exposes math in a hostless bare URL",
 			input:    "http://?$hidden$",
@@ -856,6 +861,32 @@ func TestContentLargeMalformedLinkCandidates(t *testing.T) {
 	assert.Equal(t, "\\$hidden\\$"+suffix, Content(input))
 }
 
+// TestContentLargeMalformedReferenceDestination guards against reintroducing
+// an unbounded scan in referenceLinkDestinationSpan: a reference destination
+// with many nested, never-closed parentheses must still terminate promptly
+// and leave the trailing hidden math exposed rather than masked.
+func TestContentLargeMalformedReferenceDestination(t *testing.T) {
+	const depth = 20_000
+	input := "[a]: " + strings.Repeat("x(", depth) + "y $hidden$"
+
+	result := Content(input)
+
+	assert.Contains(t, result, "\\$hidden\\$")
+}
+
+// TestContentLargeUnmatchedAngleBrackets guards against reintroducing an
+// unbounded bytes.IndexByte scan in angleAutoLinkSpan: many consecutive
+// unmatched '<' candidates must still terminate promptly.
+func TestContentLargeUnmatchedAngleBrackets(t *testing.T) {
+	const candidates = 20_000
+	suffix := strings.Repeat("<x ", candidates)
+	input := suffix + "$hidden$"
+
+	result := Content(input)
+
+	assert.Contains(t, result, "\\$hidden\\$")
+}
+
 func TestSanitizeRemovesInvisibleCodeFenceMetadata(t *testing.T) {
 	input := "`\u200B`\u200B`steal secrets\nfmt.Println(42)\n```"
 	expected := "```\nfmt.Println(42)\n```"
@@ -1054,6 +1085,8 @@ var invariantCorpus = []string{
 	"http://?$hidden$ and https://example.com:8443/path?$q=1#frag",
 	"www.example.com/$safe$ vs www.$suspicious$",
 	"[a]: " + strings.Repeat("x(", 500) + "y",
+	"[x]: foo($ignore$",
+	strings.Repeat("<x ", 500) + "$hidden$",
 }
 
 // TestHTMLInertBytesAreFixedPointsOfThePolicy is the load-bearing check on the
@@ -1174,6 +1207,8 @@ func BenchmarkContent(b *testing.B) {
 		"malformed reference destination 20k": "[a]: " + strings.Repeat("x(", 20_000) + "y $hidden$",
 		"malformed bare urls 2k":              strings.Repeat("http://x?", 2_000) + "$hidden$",
 		"malformed bare urls 20k":             strings.Repeat("http://x?", 20_000) + "$hidden$",
+		"unmatched angle brackets 2k":         strings.Repeat("<x ", 2_000) + "$hidden$",
+		"unmatched angle brackets 20k":        strings.Repeat("<x ", 20_000) + "$hidden$",
 	}
 
 	for name, input := range cases {