fix: harden profile imports and release dependencies

internal/exportimport/exportimport.go

@@ -33,6 +33,8 @@ const (
 
 	saltLength  = 32
 	nonceLength = 12 // AES-GCM standard nonce size
+
+	maxEncryptedImportBytes = 10 * 1024 * 1024
 )
 
 // ExportBundle is the cleartext payload that gets encrypted.
@@ -131,6 +133,14 @@ func DecryptAndImport(filePath, password string) ([]models.Profile, error) {
 		return nil, errors.New("exportimport: password cannot be empty")
 	}
 
+	info, err := os.Stat(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("exportimport: failed to stat file: %w", err)
+	}
+	if info.Size() > maxEncryptedImportBytes {
+		return nil, fmt.Errorf("exportimport: file is too large (max %d bytes)", maxEncryptedImportBytes)
+	}
+
 	data, err := os.ReadFile(filePath)
 	if err != nil {
 		return nil, fmt.Errorf("exportimport: failed to read file: %w", err)

internal/exportimport/exportimport_test.go

@@ -129,3 +129,24 @@ func TestDecryptCorruptFile(t *testing.T) {
 		t.Fatal("expected error for corrupt file, got nil")
 	}
 }
+
+func TestDecryptRejectsOversizedFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "huge.nexus")
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := f.Truncate(maxEncryptedImportBytes + 1); err != nil {
+		f.Close()
+		t.Fatal(err)
+	}
+	if err := f.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = DecryptAndImport(path, "password")
+	if err == nil {
+		t.Fatal("expected error for oversized file, got nil")
+	}
+}