WA-VERIFY-106: Audit JSON.load usage (prefer JSON.parse)

[kitcommerce]

Summary

Audit usage of JSON.load (prefer JSON.parse).

Approach

Run:

rg -n "\\bJSON\\.load\\b" --glob "*.rb"

For each call site:

• Replace with JSON.parse unless there's a strong, documented need for JSON.load
• Ensure any parsing of external/user data uses safe defaults

Acceptance Criteria

• No JSON.load on untrusted inputs
• Remaining usage (if any) is explicitly justified
• Tests pass (default appraisal)

Verification Plan

• Patch call sites
• Run: bundle exec rake test (affected engine(s) or default)

[kitcommerce]

Dispatch: started implementation in batch with #1111-#1114 (session: workarea-impl-1111-1114-deserialization-audits).\n\nEarly push required (branch should be pushed immediately to avoid stale resets). PR will target .

[kitcommerce]

Correction: PR base/target branch is next.