Would this sanitization make more sense in `api/posts.js` ?  Or will all data access be limited to these options, irrespective if they're coming from an API request or an internal method invocation?