Import Security Review

Untrusted video, archives, GPMF, SRT, CSV, JSON, XML, COCO, YOLO, Pascal VOC, plugins, models, manifests, and documentation assets require byte/count/string/nesting limits, safe relative paths, symlink rejection, duplicate detection, checked coordinates and timestamps, hashes, deadlines, and cancellation. Deterministic malformed fixtures exercise telemetry and package validation. No parser should infer missing measurements.