For decades, software security has relied on a deceptively simple principle: never let untrusted data become trusted instructions.
That rule shaped everything from SQL injection defenses to cross-site scripting protections, email security, operating system...