Probably paranoia, but I’d be uncomfortable feeding it a bunch of domain and server names, along with any other more interesting params that might sneak in.