If inputs are part of the application bundl3, they can be trusted as much as the code itself.