Share and AI are explicit
JSONBin and your configured LLM receive data only when you use those features. Search for token, password, authorization before you send anything.
Do not eval, do not innerHTML
Use JSON.parse. If a field contains HTML, render it as text. Filter __proto__ when merging untrusted objects in your own code.