How do you plan to have any assurance that none of your dependencies is doing it? You could well consume a string you didn't build and be affected.