For simplicity in the example in Listing 1 ... This overhead can be reduced by instructing Marten to not perform deserialization and instead just return the JSON string as stored in PostgreSQL. We can ...

I've got a C# class that is all string types, nothing fancy, and once the item is created it gets serialized with the new System.Text.Json stuff and then attempts to POST to a web server.

For example, in July this year, a critical vulnerability (CVE-2021-35464) in ForgeRock’s OpenAM stemmed from unsafe Java deserialization in the Jato framework used by the application.