A careful reading of the great advice on this page leads one to the conclusion that id-only is the best (safest) payload type. As IG authors build on top of Subscriptions, the default mandated payload type seems to be full. It would help a lot if this spec characterized the known threat vectors per payload type.

(Comment 27 - imported by: Gino Canessa)