Yep, a basic security check for any endpoint that accepts JSON: what happens when you hand it 4KiB of '[' characters