Send Input Safely
Treat user input as untrusted data: validate size, type and allowed content before sending it to your model layer.
Treat user input as untrusted data: validate size, type and allowed content before sending it to your model layer.
Check required fields and length.
Convert input into the shape your app expects.
Reject oversized or unsupported payloads.
Understand the working model
The browser should send only the data needed for the task. The server validates it again, then constructs the model request. Never assume the client already protected you.
Separate instructions from user data in your application code. This makes it easier to reason about what the model should follow and what it should merely analyze.
Practice
Apply the pattern above to one real task you already do. Keep the first version small enough that you can inspect every input and output.
Do not let the browser send arbitrary model parameters unless your server explicitly allowlists them.
Validate and normalize input on the server before it reaches your model request.