graph TD
    subgraph "Attack Surface"
        A[Malformed PE Files] -->|Parser bugs| B[Scanner Crash]
        C[Archive Bombs] -->|Memory exhaustion| D[OOM Kill]
        E[Crafted Strings] -->|Regex DoS| F[CPU Spin]
        G[Path Traversal] -->|File carving| H[Unexpected Writes]
    end
    
    subgraph "Mitigations"
        B --> I[Panic Recovery]
        D --> J["--max-analyze-bytes Cap"]
        F --> K[String Length Limits]
        H --> L[No Disk Extraction]
    end
    
    subgraph "Out of Scope"
        M[Sample Execution]
        N[Network Enrichment]
        O[Sandbox Escapes]
    end
    
    style M fill:#e94560,color:#fff
    style N fill:#e94560,color:#fff

graph LR
    A[Report Filed] --> B[Triage]
    B --> C{Severity?}
    C -->|Critical| D[Immediate Fix]
    C -->|High| E[Next Release]
    C -->|Medium/Low| F[Tracked Issue]
    D --> G[Advisory Published]
    E --> G

graph TD
    subgraph "Safe Analysis Workflow"
        A[Receive Sample] --> B[Transfer via Password Archive]
        B --> C[Import to Isolated VM]
        C --> D[Snapshot VM State]
        D --> E[Run FlatScan]
        E --> F[Review Reports]
        F --> G{Verdict?}
        G -->|Malicious| H[Escalate + Contain]
        G -->|Suspicious| I[Sandbox Analysis]
        G -->|Clean| J[Document + Archive]
        H --> K[Revert VM Snapshot]
        I --> K
        J --> K
    end

graph BT
    A["Static Analysis<br/>(FlatScan)"] -->|complements| B["Dynamic Sandbox<br/>(ANY.RUN, Joe Sandbox)"]
    B -->|complements| C["Reverse Engineering<br/>(IDA, Ghidra)"]
    C -->|complements| D["Endpoint Telemetry<br/>(EDR Logs)"]
    D -->|complements| E["Network Analysis<br/>(PCAP, DNS)"]
    E -->|complements| F["Threat Intelligence<br/>(STIX, YARA)"]

mindmap
  root((Report<br/>Contents))
    Network IOCs
      C2 URLs
      Webhook Tokens
      API Endpoints
    File Artifacts
      Registry Keys
      Internal Paths
      Embedded Strings
    Identity
      MSIX Publisher
      Certificate Metadata
      Package Names
    Technical
      Payload Hashes
      Carved Offsets
      Decoded Secrets

graph TD
    A[Extracted IOCs] --> B{Built-in Triage}
    B -->|PKI/OCSP/CRL| C[Suppressed]
    B -->|XML Schema/OID| C
    B -->|Loopback/Broadcast| C
    B -->|Clean| D[Active IOCs]
    
    E["--ioc-allowlist"] --> F{User Triage}
    D --> F
    F -->|Match| C
    F -->|Clean| G[Report IOCs]
    
    C --> H["suppression_log<br/>(auditable in JSON)"]

graph LR
    A["Current: stdlib + 1 pure-Go dep"] --> B{Adding New?}
    B -->|Must| C[Well-maintained library]
    B -->|Must| D[Pinned versions]
    B -->|Must| E[Documented rationale]
    B -->|Must| F[Parser/archive libraries reviewed carefully]