best-practices

jq Security Considerations for Untrusted Input: Architecture and Best Practices

April 11, 2026 jqlang/jq ↗

jq prevents malformed or malicious JSON from crashing processes or executing code through strict UTF-8 validation, a dedicated invalid-value propagation system, and isolated I/O abstractions that never trust external data.

When processing JSON from untrusted sources—external APIs, user uploads, or network streams—security considerations must extend beyond simple syntax validation. The jq processor treats all input as potentially hostile, implementing a defense-in-depth architecture that confines parsing errors and prevents memory corruption. By examining the source implementation in src/parser.c, src/jv.c, and `src/util

Have a question about this repo?

These articles cover the highlights, but your codebase questions are specific. Give your agent direct access to the source. Share this with your agent to get started:

Share the following with your agent to get started:

curl -s "https://instagit.com/install.md"

Add to your MCP client configuration:

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}

Ask your agent:

"Use Instagit MCP to understand how jqlang/jq works."

Works with

Claude Codex Cursor VS Code OpenClaw Any MCP Client

Maintain an open-source project? Get it listed too →