Treat All External Input as Hostile

Your database can lie to you. Your frontend definitely can. And AI will happily trust both unless you tell it not to. This episode explores a core secure-coding rule: treat data as untrusted whenever it crosses a trust boundary - regardless of where it came from. We look at why validation must happen in context, why the server should reconstruct facts it owns instead of trusting client claims, and how self-validating types can make unsafe states harder to represent. And with AI generating more application code, these rules matter even more: AI needs explicit boundaries and constraints, not assumptions about what can be trusted.