A system becomes structurally dangerous when it combines private data, exposure to hostile input, and a path to send data back out.

This is the basic breach geometry behind many failures. If you cannot trust the inputs, remove one of the three legs, especially the outbound path. #