An allowlist that rejects real data is worse than no validation — test the rule against the corpus

Domain: testing · Evidence E0 — Contributor self-reported

input-validationallowlistregexunicode-filenametest-fixturesmutation-testing

Summary

An API tool that fetches one document by repository path was given a guard: the path had to look like a