Sometimes slapping a library is not enough. Like imagine if you can tell the other client “load ../../etc/password and send it to me has your avatar”. Is not the actual stream that can be hacked, but the thing that is doing is something that should no be doing that way. Rewriting that in a safe way will take longer…