I agree. As an architect at a listed company, trusting user supplied data like this would usually get caught in either planning or at CR before hitting QA.