The spec said "handle user input securely." Three teams interpreted this differe