01 · Before and afterThe pattern
// before: toBoolean('') === false, so "?dryRun" runs a real import
const dryRun = toBoolean(req.query.dryRun);
// after: presence means on; "?dryRun=false" still turns it off
const flag = (v: unknown) => v === '' || toBoolean(v);
const dryRun = flag(req.query.dryRun);02 · Run it on your appThe check
If someone calls your destructive endpoint with ?dryRun and no value, does it write anything?
If the honest answer is no or not sure, this is worth a look before it reaches production.