@zash if it's generated by gnusocial i would consider it safe enough https://git.gnu.io/gnu/gnu-social/blob/master/lib/apiaction.php#L344