Any data that enters your system from outside a trust boundary should be treated as untrusted until proven otherwise. That includes form fields, API payloads, file uploads, headers, cookies, queue ...

I knew Google had a lot on me. I didn't expect it to show up as several gigabytes of raw files that basically amounted to a relational database of my own life. So that's what I decided to do with it — ...