Input Validation — Trim at the Boundary
Untrusted input arrives at the edges of the system. HTTP body, query, headers, environment variables, external API responses, file contents. Letting that input flow into the inner code blurs both type and meaning, and s…