Parsers are security adjacent until they aren't.