Yeah I think it's super conservative. My experience with checks is that sometimes it's possible to run into a proxy that may return whatever you send to it. Or there might be a WAF that returns a fake custom response doing the same thing. But I've never really seen any of them smart enough to eval two values found in a GET request although that is technically possible.

I think what I'll do here is do a vprint about that situation, and the user will have to decide if the response can be trusted or not.