@evan @simon isn't the purpose, and i'm genuinely asking because i don't know whether it's actually implemented this way, to ensure that a malicious actor doesn't send, say, some kind of arbitrary bytes that when consumed make the consumer exploitable?