- R2L: allowlist in tar extractor rejects files not in transfer list
- L2R: hash spot-check verifies 20 random files after upload
- R2R: size limit on relay (3x expected) prevents infinite streaming
- Warn on unexpected tar members (possible injection attempt)