possible look at json edge cases

https://github.com/zio/zio-json#security has a good description of trying to fail early for malicious json inputs. I'm not sure where jackson-databind stands with problematic json as described in the link. I guess the aim would be to fail while building the JSON AST.

Apologies if jackson(-databind) already has support for these malicious formats.