# Contributing

Keep processing local, bounded and deterministic. New MIME features require
malformed-input, nesting/size-limit and inert-rendering tests. Never add remote
content loading or message execution. Run `npm run check` and both Playwright
projects before submitting a change; update the changelog and security docs
when a boundary changes.