also, yes in my code i strictly sanitize it so it is just json, if not it won't serve it, so there's no way a malicious intrusion could rewrite the file and put javascript code into it