Security and local processing

Every input is treated as untrusted. Previews are read-only; embedded scripts, macros, formulas, and executable content are never run.

Passive structural inspection is not antivirus scanning. Resource limits, worker timeouts, and other safeguards will be enforced as plugins are added.