Probably paranoia, but I’d be uncomfortable feeding it a bunch of ___domain and server names, along with any other more interesting params that might sneak in.