It may get logged by the server but if it's designed to be parsed client-side, there may not be any server-side code examining or sanitizing that value before t

It may get logged by the server but if it's designed to be parsed client-side, there may not be any server-side code examining or sanitizing that value before the SPA gets to it.