Launch payload scanner pre-existing debt: (1) the text branch of ScanBundle reads a bundle file with an uncapped os.ReadFile while the skip-listed branch is capped at maxBinaryScanBytes, so a large text file has no memory bound; (2) .gitignore sits on defaultSkipFilenames and therefore takes the byte-rule branch though it is text, so its prose/identity coverage is weaker than any other text file; findings also accumulate uncapped across files.

Launch payload scanner pre-existing debt: (1) the text branch of ScanBundle reads a bundle file with an uncapped os.ReadFile while the skip-listed branch is capped at maxBinaryScanBytes, so a large text file has no memory bound; (2) .gitignore sits on defaultSkipFilenames and therefore takes the byte-rule branch though it is text, so its prose/identity coverage is weaker than any other text file; findings also accumulate uncapped across files.

Grounds

• pursued: every bundle read and the findings list are bounded without weakening the verdict; an oversized text file read whole, a .gitignore byte-scanned by default, or a hard fail lost to the cap would show it wrong