input validation

No SQL does not mean no injection. When a query is a JSON object, the attack is sending an object where the code expected a string.

Uploads bring classic file-handling bugs into AI products. The scored answer covers the parsers, fetchers and storage around the model, not only what the model reads.

Find representation and context mismatches without assuming a universal bypass. Place checks before the real release, preserve source authority and keep legitimate decoding useful.

Separate Unicode normalization, hidden controls, bidirectional display and confusable identifiers. Use a harmless offline example to choose field-specific checks without damaging legitimate language.

Separate task authorization, path resolution and safe publication. A resolved path is only a snapshot; test concurrent changes, protected targets and aggregate limits without treating a few passing cases as proof.