Ajv 8

Apply the JavaScript ES2026 baseline first. These rules cover Ajv 8 schema trust, strict mode, mutation options, formats, remote references, custom keywords, generated validators, errors, and resource limits.

Schema provenance and compilation

• Treat JSON Schemas as executable configuration and compile only schemas from trusted, reviewed sources.
• Never compile a schema supplied directly by an untrusted request or tenant in the privileged application process.
• Assign stable trusted schema identifiers and prevent untrusted $id values from shadowing registered schemas.
• Register only the dialects and meta-schemas the application actually supports.
• Cache validators by trusted schema identity and bound the number, size, and complexity of compiled schemas.

Strict validation behavior

• Set strict: true at security boundaries; the constructor default is strict: undefined, which means strictSchema: true throws on schema violations, strictNumbers: true rejects NaN and infinities during numeric validation, strictTypes and strictTuples only log, and strictRequired is false.
• Keep production allErrors: false (the default); allErrors: true defeats fail-fast resource controls and Ajv explicitly warns against it for production validation.
• Use explicit object shapes with required properties and an intentional additionalProperties policy.
• Set ownProperties: true when validating object trust boundaries; Ajv's default false iterates inherited enumerable properties as well as own properties, so polluted prototypes can affect validation.