UrlScanner: IP-literal, data/JS URIs, phishing TLDs, shorteners,
punycode, embedded credentials. Configurable categories.

LanguageScanner: Unicode script-ratio heuristic (Latin/Cyrillic/CJK/
Devanagari/Arabic/Greek/Hangul/Hiragana/Katakana/Thai). Catches
unexpected script switches.

CodeExecutionScanner: shell (rm -rf, curl|sh, dd, chmod 777), SQL
(DROP TABLE, TRUNCATE, DELETE FROM), injection (eval, exec, os.system,
subprocess, Process.start), filesystem (shutil.rmtree, unlink).