Constant MAX_CONFIG_BYTES 

const MAX_CONFIG_BYTES: u64 = _; // 4_194_304u64

Refuse to load a settings file larger than 4 MiB. Real settings (hooks + custom CSS + 5 profiles) come in well under 100 KiB; the cap defends against a maliciously-grown JSON file causing the loader to allocate gigabytes.