Input validation with allowlists and explicit schemas

                  RegistrationSchema = Dry::Schema.Params do
  required(:email).filled(:string, format?: URI::MailTo::EMAIL_REGEXP)
  required(:password).filled(:string, min_size?: 12)
  optional(:marketing_opt_in).filled(:bool)
  optional(:country).filled(:string, included_in?: %w[US CA GB AU])
end

result = RegistrationSchema.call(params.to_unsafe_h)
raise ActionController::BadRequest, result.errors.to_h unless result.success?