Every exposed interface becomes someone else’s input.
Anything reachable will receive malformed, surprising, and adversarial data.
Interpretation
An interface begins as a convenience for known callers and quickly becomes a boundary controlled by others. Validate structure and meaning, constrain resource use, and design failures that reveal little while remaining diagnosable internally. The more public the boundary, the less its inputs deserve assumptions.
Practice
- Validate input at the boundary with explicit limits.
- Budget time, memory, and request size.
- Return safe errors while logging diagnostic context.
Anti-pattern
Passing client-provided filenames directly to the filesystem.