The HTTP client itself is trustworthy to the extent that static code can be. The data it acquires through requests is not. Same with user input code. You can t

The HTTP client itself is trustworthy to the extent that static code can be. The data it acquires through requests is not. Same with user input code. You can trust your implementation to the extent of static type checking and analysis. You can't trust anything a user entered into your system. Those are examples of the externals that I stated you can't trust.