Comment by yardstick

They’ve suggested blocking ${ in the request