Each piece of code should enforce its own contracts explicitly across communication boundaries. If your backend relies on x input being parseable as a number, i

Each piece of code should enforce its own contracts explicitly across communication boundaries. If your backend relies on x input being parseable as a number, it shouldn't assume that it is just because you know that it ultimately came from a number picker in an HTML form - it should check for itself. This is defensive not just for security, but so that when you change something later and screw it up you get actual error messages instead of silent breakage.