Untrusted input

A file you pickedan upload, a drop, a share

A fetched or stored assetread back from storage or the network

A link parameterevery link is public

A file inside a filea profile in a JPEG, a part in a deck

The parser

Named limits, checked before reading
  • size of each part
  • count of records
  • depth of nesting
  • every declared length

One stated answer

Read what it canthe readable parts, or a note; never throws

Stop at oncea clear error, before any cryptographic check

Refusea privacy or security control never fails open