tfw you see someone ship a blacklist of the POC to fix their untrusted string meta programming RCE, twice on the same feature