In the case that you describe, I'd specifically recommend using taint mode and leaving that incoming data tainted as a reminder that it isn't supposed to be used for anything else.