Hacker News Reader

How does

> a ton of additional complexity with a proven track record of CVEs

become:

> adding it in couldn’t hurt

?

By running it in an ephemeral container with no network access for each file you want to check?