Reviews code that turns untrusted bytes into objects or documents. Paste the parsing code, its configuration, and the source of the input to trace unsafe object deserialization, XML external entities, entity expansion, unsafe YAML loaders, and type-controlled polymorphic binding. Returns a verdict, an input-to-parser map, evidence-linked findings, the smallest safe replacement, and checks that reject hostile input while still accepting valid input. Written for backend developers who accept uploads, queue messages, or API payloads. Separates parsers that execute code from parsers that only consume resources, and states missing library versions instead of inventing defaults. A code review prompt, not a live scanner or a security certification.