Our security detection picks out specific issues in-context, or escapes to make them non-issues -- trying to spot suspicious patterns across any parameter out-of-context would lead to performance slow-down and bugs.
Is there any way that errors can track IPs, like security logs do? That way, I can ban bots like this as well as these bots/people who keep adding random URLs to the end of /pg/ .
If they had for example ".." in this parameter, we'd pick it up as a file-system attack, as this parameter is being used in a file-system context.