scenario-text-overlay

This module is primarily a rendering utility, not an obvious malicious payload. However, it can be security-relevant when `payload` is attacker-controlled: it performs outbound network requests to an arbitrary user-supplied `.ttf/.otf` URL (SSRF-like reachability) and then writes and parses attacker-controlled font binaries via PIL’s font loader. Additionally, attacker-controlled canvas/bbox and shrink-to-fit logic can enable CPU/memory DoS. No clear evidence of credential theft, command execution, or direct data exfiltration is present in this fragment. A separate reliability issue exists (likely `return canva` typo).