Function is_valid_definition_id 

pub fn is_valid_definition_id(s: &str) -> bool

Returns true if s matches [A-Za-z0-9_-]+. Rejects empty.

We’re embedding definition_id into a zone name (a string the frontend can supply via RPC), so anything outside the safe set would let an attacker write/read arbitrary zones. UUIDs (the production definition_id shape) are a strict subset of this character class.