> The alternative is auditing every single endpoint to ensure that it won't leak attacker data into the response, I think you're underestimating how common thi

> The alternative is auditing every single endpoint to ensure that it won't leak attacker data into the response, I think you're underestimating how common this is. For example, view source on https://www.google.com/search?q=pajamas https://www.google.com/search?q=pajamas and look at how many times "pajamas" appears on the page. This is a simple example, but query string parameters (and other attacker-controlled data) get reflected in server responses all the time. Eliminating this behavior is not a realistic goal.