Pipelines parse bytes written by others, so every parser is attack surface: formats that can name code to run, inputs small on disk but huge once decoded, and inputs built to hit a parser's limits. Each demo below stays on local data, sized well inside this machine's memory.