security: 23 Critical/High panic-attack findings need human triage (Track C)

[hyperpolymath]

panic-attack estate sweep — Track C tracking issue

panic-attack assail flagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).

PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in audits/assail-classifications.a2ml are also excluded.

Estate tracker: hyperpolymath/panic-attack#32.

SupplyChain (1 findings)

file:line list

### `UnboundedAllocation` (22 findings)

file:line list

Critical  crates/protocol-squisher-bebop-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-bebop-analyzer/src/parser.rs
Critical  crates/protocol-squisher-rust-analyzer/src/lib.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-rust-analyzer/src/lib.rs
Critical  crates/protocol-squisher-rust-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-rust-analyzer/src/parser.rs
Critical  crates/protocol-squisher-graphql-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-graphql-analyzer/src/parser.rs
Critical  crates/protocol-squisher-toml-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-toml-analyzer/src/parser.rs
Critical  crates/protocol-squisher-capnproto-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-capnproto-analyzer/src/parser.rs
Critical  crates/protocol-squisher-avro-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-avro-analyzer/src/parser.rs
Critical  crates/protocol-squisher-enterprise/src/registry.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-enterprise/src/registry.rs
Critical  crates/protocol-squisher-enterprise/src/marketplace.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-enterprise/src/marketplace.rs
Critical  crates/protocol-squisher-flatbuffers-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-flatbuffers-analyzer/src/parser.rs
Critical  crates/shape-ir/src/information.rs:?  Potential unbounded allocation pattern detected in crates/shape-ir/src/information.rs
Critical  crates/protocol-squisher-distributed/src/recovery.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-distributed/src/recovery.rs
Critical  crates/protocol-squisher-json-schema-analyzer/src/lib.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-json-schema-analyzer/src/lib.rs
Critical  crates/protocol-squisher-messagepack-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-messagepack-analyzer/src/parser.rs
Critical  crates/protocol-squisher-openapi-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-openapi-analyzer/src/parser.rs
Critical  crates/protocol-squisher-sql-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-sql-analyzer/src/parser.rs
Critical  crates/protocol-squisher-rescript-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-rescript-analyzer/src/parser.rs
Critical  crates/protocol-squisher-protobuf-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-protobuf-analyzer/src/parser.rs
Critical  crates/protocol-squisher-thrift-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-thrift-analyzer/src/parser.rs
Critical  crates/protocol-squisher-arrow-analyzer/src/parser.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-arrow-analyzer/src/parser.rs
Critical  crates/protocol-squisher-optimizer/src/ephapax_optimizer.rs:?  Potential unbounded allocation pattern detected in crates/protocol-squisher-optimizer/src/ephapax_optimizer.rs

---

🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.