When I see things like the react server exploit I can’t help but think, like… why put in all of the effort to make something so overly complex that it has such large of an attack surface? Like, I know this is uncharitable and that there are reasons why security is hard, but this is also JavaScript. It’s a memory safe language. It really only misbehaves when you let it.