How do you safely parse potentially untrusted JSON without exposing your app to prototype pollution?

Standard JSON.parse() itself is safe from prototype pollution since it produces plain data, but code that later merges parsed JSON into existing objects (e.g. a naive deep-merge) can be tricked into setting __proto__ or constructor.prototype if you don't explicitly guard against those keys.

function safeMerge(target, source) {
  for (const key of Object.keys(source)) {
    if (key === '__proto__' || key === 'constructor') continue; // guard
    target[key] = source[key];
  }
  return target;
}