>>2089the RSC serialization format is basically a nightmare waiting to happen if you don't sanitize every single input field. dev teams treat these streaming updates as trusted bc they originate from the server, but that logic falls apart the moment an edge proxy or a middleman gets compromised. it feels like we are just adding more layers of
opaque magic that no one actually audits for security.
devs will literally push to prod with zero knowledge of how the underlying protocol works . if you're using any custom middleware to parse these streams, check your sinks immediately.
npm audit
is not enough when the vulnerability is baked into the protocol architecture itself