> This is a sanity check, [...] > 2. Not parsing the JSON in the browser, but sending off to a serverless/cloud function api There's your check: this part is

> This is a sanity check, [...] > 2. Not parsing the JSON in the browser, but sending off to a serverless/cloud function api There's your check: this part is insane. Also, this is a common problem with programmers who haven't received formal training: > 3. Checking string input with regex and other typical tools before parsing/using. Do not rely with your security on regular expressions. They are a very unwieldy tool for this purpose. Use a proper parser and don't even bother with regexps (maybe barring the regexps in the tokenizer).