A dedicated static_analysis.py module with a registry of inspectors. Every attachment runs through all of them, and nothing is ever executed; it's pure byte parsing.
Each check returns findings with a severity, the exact evidence observed, and a plain-language explanation.
Full Changelog: v1.0.0...v1.0.1