[security] apps/zig/src/app.zig:218: A POST to /todos with title=a%80%80%80%80 makes the backward trimming scan pass five bytes to std.unicode.utf8Decode, which reaches unreachable and aborts the ReleaseSafe server. One unauthenticated request can therefore terminate the shared instance. Validate UTF-8 before trimming, or check the sequence length and leading byte before decoding.
amadan