1. [security] `apps/zig/src/app.zig:218`: A POST to `/todos` with `title=a%80%80%80%80` makes the backward trimming scan pass five bytes to `std.unicode.utf8Decode`, which reaches `unreachable` and aborts the ReleaseSafe server. One unauthenticated request can therefore terminate the shared instance. Validate UTF-8 before trimming, or check the sequence length and leading byte before decoding.
amadan