"I think the original intent of the spec was to allow some flexibility... in practice supporting this flexibility lead to some vulnerabilities." This statement

"I think the original intent of the spec was to allow some flexibility... in practice supporting this flexibility lead to some vulnerabilities." This statement applies to roughly half of all security issues I have ever seen. I'm not making a joke or being flippant, and it reenforces what you need to consider when designing specs or APIs. Specs have surface area just like code does, and decreasing it often has positive outcomes for security.