What precautions should be taken when using Stockfish in e.g. a server?

[DemiMarie]

The FAQ includes:

Stockfish crashed

Stockfish may crash if fed incorrect fens, or fens with illegal positions. Full validation code is complex to write, and within the UCI protocol, there is no established mechanism to communicate such an error back to the GUI. Therefore Stockfish is written with the expectation that the input fen is correct.

On the other hand, the GUI must carefully check fens. If you find a GUI through which you can crash Stockfish or any other engine, then by all means report it to that GUI's developers.

It is fairly easy to ensure that the FEN provided to Stockfish is syntactically correct, but checking that a position is legal is quite
tricky and not something that a UI or server can reasonably be expected to do. However, there are simpler checks that definitely can be done:

• Each side has exactly one king and up to 15 other pieces, at most 8 of which can be pawns.
• There are no pawns on the first or eighth rank.

Sandboxing, hardening compiler flags, and other generic security measures are also useful, but they are orthogonal to this discussion.

[vdbergh]

There is actually a sensible PR about this: #4563 . It seems to be in limbo though. I don't know why.