I wrote a type checking utility that also considers all types (JS without TypeScript, so this meant arrays etc.). The desired type had to be declared in a config file and the data didn’t even come from the config.

What would I not do to prevent all possible attack vectors...