Contributing

Keep processing local, bounded and deterministic. New MIME features require malformed-input, nesting/size-limit and inert-rendering tests. Never add remote content loading or message execution. Run npm run check and both Playwright projects before submitting a change; update the changelog and security docs when a boundary changes.