it's impossible to sanitize for every possible API all at once