Psych.safe_load restricts object classes, not the data shape

Ruby applications use YAML for configuration, fixtures, job payloads, and user-import files. Psych.safe_load is the right entry point for untrusted YAML because it limits which Ruby classes may be constructed. The limitation is easy to misread. Allowing a class means the parser may build that class. It does not validate the object graph, the size of aliases, or whether the application code that receives the object can safely process it.

Start with an allowlist that is actually small

Psych.safe_load raises Psych::DisallowedClass when the document contains a class that is not listed in permitted_classes . The default is intentionally restrictive. Pass only the types that the schema needs, such as Date when the document contains date fields. Do not pass a broad list copied from another service because one application needed symbols or a custom class.

That decision belongs beside the parser call and should have a test.…